Hi Michael, Have you confirmed the security problem? I've had time when the EEPROM got zeroed out and I couldn't access the module via SMS at all. I had to reflash with a valid EEPROM image in order to re-register my cell number. I'm pretty careful not to share my OVMS phone number with anyone. If someone unfriendly had it, they could send it a bunch of SMS messages each of which costs me a penny. Do that 1,000 times, and they've disabled my box until I refill my H2O account. Tom -----Original Message----- From: Michael Balzer <dexter@expeedo.de> Reply-To: OVMS Developers <ovmsdev@lists.teslaclub.hk> Date: Tuesday, July 21, 2015 at 9:23 AM To: OVMS Developers <ovmsdev@lists.teslaclub.hk> Subject: [Ovmsdev] Registered phone / password security issue
Hi everyone,
some users including me experienced loss or garbling of eeprom parameters. I once saw by chance that my registered phone number had turned empty -- I seldom need to use SMS, so I only saw this when checking the parameter list on the App for another config.
The same now also occured to another user I'm in contact with, and it now turned out that's not only annoying but a security issue:
The current logic of net_sms_checkcaller() allows access to any phone number if the parameter is empty. The same applies to net_sms_checkpassarg(), which will allow any password to be used if no password is stored.
As this kind of data loss can only be detected by checking the parameters, it's possible to check for "open" modules by just trying to access them from time to time -- you only need to know the SIM card number.
I'm about to submit a change for both functions to NOT allow access if their respective param slots are empty.
As the initial flash contents has the "OVMS" standard password, a completely lost module should still be restorable by re-flashing.
Do I miss something? Is there any reason for the "empty=wildcard" behaviour?
Regards, Michael
-- Michael Balzer * Helkenberger Weg 9 * D-58256 Ennepetal Fon 02333 / 833 5735 * Handy 0176 / 206 989 26
_______________________________________________ OvmsDev mailing list OvmsDev@lists.teslaclub.hk http://lists.teslaclub.hk/mailman/listinfo/ovmsdev