Abstract: Residence Assistant had two safety audits completed as a part of our common safety assessments. You’re protected. No authentication bypasses have been discovered. We did repair points associated to attackers probably tricking customers to take over their occasion. All fixes are included in Residence Assistant 2023.9 (launched on September 6, 2023) and the most recent Residence Assistant apps for iOS and Android. Please ensure you’re up-to-date.
Safety is essential to us at Residence Assistant and Nabu Casa. Being open supply makes it simple to let anybody audit our code—and primarily based on reported points—individuals do. Nevertheless, you additionally want to rent individuals to do an precise safety audit to make sure that all of the necessary code has been coated.
Subscribing to Residence Assistant Cloud supplies funding for the continued growth and upkeep of Residence Assistant, together with exterior safety audits. To make sure that our safety is top-notch, Nabu Casa employed Cure53 to carry out a safety audit of vital components of Residence Assistant. Cure53 is a widely known cybersecurity agency that previously discovered vulnerabilities in Mastodon and Ring merchandise.
Cure53 discovered points in Residence Assistant, 3 of which have been marked as “vital” severity. The vital points would enable an attacker to trick customers and steal login credentials. All reported points have been addressed as a part of Residence Assistant 2023.9, launched on September 6, 2023. No authentication bypass points have been discovered. In keeping with Cure53’s report:
The standard of the codebase was spectacular on the entire, while the structure and frameworks deployed in all related utility areas resilient design paradigms generally. Frontend safety specifically exhibited ample alternatives for hardening, as compounded by the Important related dangers recognized. Nonetheless, as soon as these have been mitigated, an exemplary safety posture will definitely be attainable.
In August, the GitHub Safety Lab additionally audited Residence Assistant. They discovered six non-critical points throughout Residence Assistant Core and our iOS and Android apps. Two of the problems overlapped with Cure53. All reported points have been fastened and launched.
We wish to thank each groups for his or her audits, reported points, and protecting our customers protected 🙏
All discovered points have been added to our safety web page. This web page has been up to date to incorporate an ongoing timeline of reported points, who disclosed it, and a hyperlink to the difficulty report on GitHub.
When you suppose you’ve discovered a safety subject, take a look at our safety web page on easy methods to report this to Residence Assistant.
