CRITICAL (11)
- C1: DNS leak bypasses Tor, ISP can see all relay hostnames in plaintext
- C2: No kill switch when Tor fails, traffic silently falls back to clearnet
- C3: Cleartext HTTP traffic allowed globally in the Android manifest
- C4: Noise protocol session keys written to logcat in release builds
- C5: Stable peer ID in BLE advertising lets anyone track devices across sessions
- C6: Hardcoded BLE service UUID acts as a “I use Zemzeme” beacon to any scanner
- C7: Nicknames and public keys broadcast unencrypted over BLE every 30 seconds
- C8: Gossip TLV leaks the full social graph in cleartext to passive listeners
- C9: All chat metadata sits in unencrypted SharedPreferences on disk
- C10: Street-level GPS coordinates and an app-identifying User-Agent sent to OpenStreetMap
- C11: Google cloud backup can exfiltrate private keys, voice recordings, and images
No comments:
Post a Comment