Saturday, December 9, 2017

Vulnerability in Wickr: Bypassing Password on Android

Summary

I have reported this issue directly to Wickr on Sep 12th to the Wickr team. Within few hours, they escalated the ticket to the devs and confirmed my findings & that they're fixing it.

The bug has been fixed for a while now, and you're urged to make sure you have the latest version.

Vulnerability Description

I have enabled the auth option to require a password. However, as soon as I switch to another app, it requires a lock immediately.

To bypass the lock, first I open recent apps context menu in Android and select Wickr. The lock screen shows. Then, I click on a Wickr message notification from the notification drop menu. It immediately opens the message itself and if I click the back button, it opens the main chat list and I can browse other chats. No password needed.

I also noticed that if I click the notification first, it does ask for a password, so first Wickr has to be selected from the recent apps, then click on the notification.


Bonus

The Wickr team was super friendly and offered me some freebies: tshirts, a hoodie, and stickers. The app is free and open source, and I'm quite happy to have been able to give back to the community, so the bonus stuff made me feel extra special.

Big thumbs up the Wickr team for their extremely fast response and fix to the issue.

Wednesday, November 15, 2017

Blockchain & Crypto Currency Introduction Seminar

In collaboration with Sirdab Lab, I'll be talking about something that I should've since 2010: Crypto currencies.

The introduction's title is: 'Intro to Crypto Currencies: Blockchain, Bitcoin & Other Bits' on Monday December 4th, 2017 at 6 PM (1800).

The content will be suitable for newbies, traders, bankers, investors, law makers and the generally curious.



Sirdab Lab's location: Dasman Complex Ground floor, Jaber Al-Mubarak St, Sharq, Kuwait City. (Google Maps).

Update:
The session was recorded and the slides & audio were merged into a video that's available now online: https://www.youtube.com/watch?v=_Mu9_PcyJi0

The description has links to the slides and the raw mp3 file, for those who want to listen to the audio online. The slides have notes under each slide for added discussion and elaboration.

Link to the slides: https://goo.gl/bcZFmi
Link to the mp3 audio file: https://goo.gl/bHTRmC