{"action":"opened","issue":{"url":"https://api.github.com/repos/Microsoft/BotBuilder/issues/438","repository_url":"https://api.github.com/repos/Microsoft/BotBuilder","labels_url":"https://api.github.com/repos/Microsoft/BotBuilder/issues/438/labels{/name}","comments_url":"https://api.github.com/repos/Microsoft/BotBuilder/issues/438/comments","events_url":"https://api.github.com/repos/Microsoft/BotBuilder/issues/438/events","html_url":"https://github.com/Microsoft/BotBuilder/issues/438","id":158787509,"number":438,"title":"How to protect against replay attacks in Bot Builder?","user":{"login":"whatsdis","id":7296901,"avatar_url":"https://avatars.githubusercontent.com/u/7296901?v=3","gravatar_id":"","url":"https://api.github.com/users/whatsdis","html_url":"https://github.com/whatsdis","followers_url":"https://api.github.com/users/whatsdis/followers","following_url":"https://api.github.com/users/whatsdis/following{/other_user}","gists_url":"https://api.github.com/users/whatsdis/gists{/gist_id}","starred_url":"https://api.github.com/users/whatsdis/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/whatsdis/subscriptions","organizations_url":"https://api.github.com/users/whatsdis/orgs","repos_url":"https://api.github.com/users/whatsdis/repos","events_url":"https://api.github.com/users/whatsdis/events{/privacy}","received_events_url":"https://api.github.com/users/whatsdis/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2016-06-06T22:12:24Z","updated_at":"2016-06-06T22:12:24Z","closed_at":null,"body":"First an example of a replay attack from wikipedia:\r\n\r\n> Suppose Alice wants to prove her identity to Bob. Bob requests her password as proof of identity, which Alice dutifully provides (possibly after some transformation like a hash function); meanwhile, Eve is eavesdropping on the conversation and keeps the password (or the hash). After the interchange is over, Eve (posing as Alice) connects to Bob; when asked for a proof of identity, Eve sends Alice's password (or hash) read from the last session, which Bob accepts thus granting access to Eve.\r\n\r\n\r\n1) How does Bot Builder distinguish devices via SMS? How are the userdata being associated with the end user through SMS? Does it look at the originating phone number and able to connect the relevant userdata to it? Is this secure enough? What if somebody takes a look at the conversationId and userId , and use it launch replay attacks using those intercepted or stolen pieces of data?\r\n\r\n2) How does Bot Builder make the contents of the SMS texts going back and forth from the user to the Bot Builder instance running on Azure?\r\n\r\n3) Are there other security concerns/vulnerability in using Bot Builder that I should be aware of?\r\n\r\n\r\n"}}
{"actor":{"display_login":"whatsdis"}}