{"action":"opened","issue":{"url":"https://api.github.com/repos/Pryaxis/TShock/issues/1631","repository_url":"https://api.github.com/repos/Pryaxis/TShock","labels_url":"https://api.github.com/repos/Pryaxis/TShock/issues/1631/labels{/name}","comments_url":"https://api.github.com/repos/Pryaxis/TShock/issues/1631/comments","events_url":"https://api.github.com/repos/Pryaxis/TShock/issues/1631/events","html_url":"https://github.com/Pryaxis/TShock/issues/1631","id":350814227,"node_id":"MDU6SXNzdWUzNTA4MTQyMjc=","number":1631,"title":"[Security] Tshock stats collection security concerns. Related to #1446.","user":{"login":"pgwipeout","id":745725,"node_id":"MDQ6VXNlcjc0NTcyNQ==","avatar_url":"https://avatars3.githubusercontent.com/u/745725?v=4","gravatar_id":"","url":"https://api.github.com/users/pgwipeout","html_url":"https://github.com/pgwipeout","followers_url":"https://api.github.com/users/pgwipeout/followers","following_url":"https://api.github.com/users/pgwipeout/following{/other_user}","gists_url":"https://api.github.com/users/pgwipeout/gists{/gist_id}","starred_url":"https://api.github.com/users/pgwipeout/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pgwipeout/subscriptions","organizations_url":"https://api.github.com/users/pgwipeout/orgs","repos_url":"https://api.github.com/users/pgwipeout/repos","events_url":"https://api.github.com/users/pgwipeout/events{/privacy}","received_events_url":"https://api.github.com/users/pgwipeout/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-08-15T13:43:57Z","updated_at":"2018-08-15T13:43:57Z","closed_at":null,"author_association":"NONE","body":"Tshock Stats Collector is making round robin connections to various AWS buckets and using GET requests to post statistical data on the server. \r\nThe Tshock server \r\nThe following security concerns currently apply to the current system:\r\n- Connections are made over HTTP, with all data in clear text.\r\n- Data posted contains the current port the server is running on.\r\n- Use of HTTP means there can be no client verification of the identity of the server.\r\n- Exposure of the listening port in the GET request, combined with the IP address of the server broadcasts the server identity to malicious actors.\r\n- The Stats Collector is embedded in a closed source binary included in the open source code, making transparency and auditing difficult.\r\n- The Stats Collector has a disable flag, --stats-optout, but it is not documented in the configuration documentation.\r\n\r\nThis servers are currently responding with the following:\r\n{\"extra\":\"Ichigo is the best.\",\"also\":\"The TShock stats server is offline intentionally.\"}\r\n\r\nThe server's HTTPS certificate is invalid, due to being assigned to *.bikelanesolutions.com\r\n\r\nIn addition, the following concerns were raised in Issue ticket #1446:\r\n- Lack of notification of the existence of the Stats Collector.\r\n- Lack of transparency.\r\n\r\nIt is mentioned at the close of ticket #1446 that the Stats Collector was killed on May 21, however the Stats Collector is still connecting to servers and posting data.\r\n\r\nAs such, the following changes are recommended:\r\n- Move the Stats Collector to the Tshock open source code base.\r\n- Convert the Stats Collector to use only HTTPS connections to prevent Man in the Middle attacks and to ensure data integrity.\r\n- Ensure the Stats Collector performs certificate verification of the receiving server to prevent spoofing attacks.\r\n- Make the server explicitly declare the existence of the Stats Collector.\r\n- Make the Stats Collector opt-in vice opt-out.\r\n\r\nConfirmed valid as of TShock version: 4.3.25 on August 15th, 2018.\r\n"}}
{"actor":{"display_login":"pgwipeout"}}