Saturday, February 28, 2026

برسد به دست تیم سازنده پیام رسان زمزمه. #زمزمه یک بررسی امنیتی کامل روی زمزمه انجام دادم. زمزمه یک اپلیکیشن چت مش بلوتوث متن‌باز هست که از کد بیت چت استفاده می‌کند. مجموع ۵۸ آسیب‌پذیری پیدا کردیم که ۱۱ تاش بحرانی هستند. یوتوب: https://youtu.be/HuAA790BuJM




 CRITICAL (11)
- C1: DNS leak bypasses Tor, ISP can see all relay hostnames in plaintext
- C2: No kill switch when Tor fails, traffic silently falls back to clearnet
- C3: Cleartext HTTP traffic allowed globally in the Android manifest
- C4: Noise protocol session keys written to logcat in release builds
- C5: Stable peer ID in BLE advertising lets anyone track devices across sessions
- C6: Hardcoded BLE service UUID acts as a “I use Zemzeme” beacon to any scanner
- C7: Nicknames and public keys broadcast unencrypted over BLE every 30 seconds
- C8: Gossip TLV leaks the full social graph in cleartext to passive listeners
- C9: All chat metadata sits in unencrypted SharedPreferences on disk
- C10: Street-level GPS coordinates and an app-identifying User-Agent sent to OpenStreetMap
- C11: Google cloud backup can exfiltrate private keys, voice recordings, and images

No comments: