Conversation

Notices

1. Embed this notice
   Alex Gleason (alex@gleasonator.com)'s status on Sunday, 04-Feb-2024 12:57:03 JST Alex Gleason

   • Dan Ramos 🇵🇹🇺🇸 :verified:
   "Mastodon vulnerability allows attackers to take over accounts"
   
   Snopes: Mixed
   
   It's a serious vulnerability for sure: "allowing attackers to impersonate users and take over their accounts"
   
   But while this part is true: "allowing attackers to impersonate users"
   
   This part is exaggerated: "and take over their accounts"
   
   Impersonating remote users doesn't allow you to log in as them, change their email or password, etc. It allows people to submit forged posts by them, and "trick" Mastodon servers into accepting it. Either way, interesting that this leaks into the wider web.
   
   RT: https://noauthority.social/users/Dan_Ramos/statuses/111871157549735051
   • Embed this notice
     arcanicanis (arcanicanis@were.social)'s status on Friday, 16-Feb-2024 07:15:54 JST arcanicanis

     in reply to

     • arcanicanis
     • Dan Ramos 🇵🇹🇺🇸 :verified:
     Here's the 'more info':
     
     https://were.social/notice/AeuTOL78x560sfdeFc
     
     https://arcanican.is/excerpts/cve-2024-23832/
     
     https://arcanican.is/excerpts/cve-2024-23832/discovery.htm
   • Embed this notice
     arcanicanis (arcanicanis@were.social)'s status on Friday, 16-Feb-2024 07:15:58 JST arcanicanis

     in reply to

     • Dan Ramos 🇵🇹🇺🇸 :verified:

     This part is exaggerated: “and take over their accounts”

     More info will come later regarding this.

     Alex Gleason repeated this.
   • Embed this notice
     Alex Gleason (alex@gleasonator.com)'s status on Friday, 16-Feb-2024 07:17:20 JST Alex Gleason

     in reply to

     • arcanicanis
     • Dan Ramos 🇵🇹🇺🇸 :verified:
     @arcanicanis @Dan_Ramos It's pretty awesome. But I stand by my statement that "taking over accounts" is an exaggeration, because you cannot actually log in as them or change their password. Impersonation is a critical security issue. But people should not believe this can let people lock them out of their account.
   • Embed this notice
     arcanicanis (arcanicanis@were.social)'s status on Friday, 16-Feb-2024 07:33:09 JST arcanicanis

     in reply to

     • Dan Ramos 🇵🇹🇺🇸 :verified:

     Well, it’s really close in severity: when you can take over the deliverability of their posts to any followers (on any software) that aren’t on the same server, when you can take over where Direct Messages across servers end up, when you can change the public key cached for any remote user and start impersonating S2S traffic, and much more.

     Alex Gleason likes this.