Security review M8 completed

Before the first release candidate, Hiatus Remote went through a dedicated security review. The report extends the threat model by five attackers and attack surfaces and walks through the code in five areas.

Result

• 24 findings (R1–R24), none critical. One high finding (remote debugger in service mode without UAC), five medium ones (among them an unchecked data directory of the service, bypassing the lockout via parallel sessions, the one-time password shown to all user interfaces, a selectable installation folder) and notes I1–I7.
• Every finding was verified in the code and decided individually: fix, deliberately keep, or defer. All findings marked for fixing have been in the code since 22 October and were confirmed live on the test VM.
• Tools: clang-tidy and MSVC code analysis ran without findings; the CVE check of all dependencies via the NVD (125 entries checked one by one) found nothing exploitable. The overnight fuzzing run with 17 targets found no defects in the product; findings in an embedded terminal library were fixed with patches.

What changed as a result

• The service checks its data directory before reading it, the installation folder gets its own permissions, and the private TLS key is created with restricted permissions from the start.
• The lockout after failed attempts can no longer be bypassed via parallel sessions; the penalty time resets after 24 hours.
• “Only approved supporters” rejects unknown keys before the password check; a known supporter ID with a different key triggers a warning.
• Images from the clipboard are decoded in the decoder sandbox, on the supporter side too.

A redacted version of the report will be published in the security section.