4 ms·

And a few hours later a french researcher[1] found some embarrassing flaws[2], including one from python's standard lib[3]. [1] https://twitter.com/fs0c131y ht

by kawera 8y ago

And a few hours later a french researcher[1] found some embarrassing flaws[2], including one from python's standard lib[3]. [1] https://twitter.com/fs0c131y https://twitter.com/fs0c131y [2] https://medium.com/@fs0c131y/tchap-the-super-not-secure-app-of-the-french-government-84b31517d144 https://medium.com/@fs0c131y/tchap-the-super-not-secure-app-... [3] https://twitter.com/fs0c131y/status/1119143946687434753/video/1 https://twitter.com/fs0c131y/status/1119143946687434753/vide...

Iv 8y ago
tl;dr: this app is supposed to be used only for governmental staff. It does so by checking if you have a @elysee.fr or a @gouv.fr email. He bypassed the check by using myadress@protonmail@presidence@elysee.fr. He could access the "public" groups normally reserved for employees. The hole has been plugged.
- Arathorn 8y ago
  Yup, there was a single bug here (which I wrote; serves me right for blindly trusting a mail addr parsing library), which boils down to: $ python -c "import email.utils; print email.utils.parseaddr('bob@evil.com')" ('', 'bob@evil.com') $ python -c "import email.utils; print email.utils.parseaddr('bob@evil.com@gouv.fr')" ('', 'bob@evil.com') We deployed a fix within about 90 mins of being alerted, and also released an security update for anyone else who is in the same situation (which is very unlikely): https://matrix.org/blog/2019/04/18/security-update-sydent-1-0-2/ https://matrix.org/blog/2019/04/18/security-update-sydent-1-...
  - Iv 8y ago
    I am not a webdev so I may be totally out of the loop here but when I was still in engineering school I was told to never trust a user just because of their email because it can easily be spoofed. It is not the case anymore? And also I am a bit surprised that government employees don't have a way to authenticate themselves? I thought at least the president and several military staff already had secure phone that used the (kinda unluckily named) Isis network?
    - Arathorn 8y ago
      the way the auth works is to send an email to the gouv.fr address to get the user to click a verification link. this should be fairly trustworthy (ignoring the bug here where verification mail got sent to the attacker’s address :|)

by kawera 8y ago

Iv 8y ago

tl;dr: this app is supposed to be used only for governmental staff. It does so by checking if you have a @elysee.fr or a @gouv.fr email. He bypassed the check by using myadress@protonmail@presidence@elysee.fr. He could access the "public" groups normally reserved for employees. The hole has been plugged.

Arathorn 8y ago
Yup, there was a single bug here (which I wrote; serves me right for blindly trusting a mail addr parsing library), which boils down to: $ python -c "import email.utils; print email.utils.parseaddr('bob@evil.com')" ('', 'bob@evil.com') $ python -c "import email.utils; print email.utils.parseaddr('bob@evil.com@gouv.fr')" ('', 'bob@evil.com') We deployed a fix within about 90 mins of being alerted, and also released an security update for anyone else who is in the same situation (which is very unlikely): https://matrix.org/blog/2019/04/18/security-update-sydent-1-0-2/ https://matrix.org/blog/2019/04/18/security-update-sydent-1-...
- Iv 8y ago
  I am not a webdev so I may be totally out of the loop here but when I was still in engineering school I was told to never trust a user just because of their email because it can easily be spoofed. It is not the case anymore? And also I am a bit surprised that government employees don't have a way to authenticate themselves? I thought at least the president and several military staff already had secure phone that used the (kinda unluckily named) Isis network?
  - Arathorn 8y ago
    the way the auth works is to send an email to the gouv.fr address to get the user to click a verification link. this should be fairly trustworthy (ignoring the bug here where verification mail got sent to the attacker’s address :|)