Security Issue (Group 2): Possible Eavesdropping and Credential or Secret Exposure.

The security guard application has a secret which is necessary for reading and writing the logs. The adversary can easily find out secrets by sniffing the transmitted packets as there is no encryption over SSL. Also, the client application is a very simple one and can be substituted by this very simple command.

nc <server-ip> <port>

Adversaries can easily append to logs and read them.

The following is the screenshot from Wireshark application, showing the exposure of the secret. {6CE3A152-399C-4461-8A39-10B16CD361A8}

If you wish you can access the TCP dump file.

IITGN-CS431 / project-cns

Security Issue (Group 2): Possible Eavesdropping and Credential or Secret Exposure. #256