A Debian Testing repository package, StarDict, which implements an interface for searching dictionaries, has revealed a privacy issue — by default, the application automatically sends selected text (x11 PRIMARY selection) to external servers. Selecting any text snippet in any application immediately sends it unencrypted over HTTP to Chinese online dictionary servers dict.youdao.com and dict.cn. This issue is only present in environments based on the X11 protocol, as Wayland applies clipboard isolation by default.
The accompanying StarDict package in Debian has responded that such behavior is standard. By default, StarDict enables automatic search mode for selected text, and both local and external dictionaries are activated. The servers dict.youdao.com and dict.cn provide English-Chinese dictionaries that can be accessed through plugins, which are enabled by default when installing the stardict-plugin package, recommended as a dependency for the stardict-gtk package. Users dissatisfied with this behavior are advised to disable network dictionaries or the automatic search function in the settings.
A user who noticed the issue argued that such behavior should never be activated by default, as it leads to information leakage. Users may highlight text in applications that contains sensitive information, such as passwords and personal data. szervereken As a result, the information not only potentially lingers in logs on dict.youdao.com and dict.cn, visible to their administrators, but it also becomes vulnerable to traffic interception due to the use of HTTP instead of HTTPS. 911565 write(16, "GET HTTP://dict.youdao.com/fsearch?q=selected text HTTP/1.0\r\nUser-Agent: Mozilla/4.0(compatible;MSIE 5.00;Windows 98)\r\nAccept: */*\r\nHost: dict.youdao.com\r\nConnection: close\r\n\r\n", 171) = 171 911565 write(17, "GET HTTP://dict.cn/ws.php?utf8=true&q=selected text HTTP/1.0\r\nUser-Agent: Mozilla/4.0(compatible;MSIE 5.00;Windows 98)\r\nAccept: */*\r\nHost: dict.cn\r\nConnection: close\r\n\r\n", 164) = 164
It is noteworthy that in 2009, similar behavior in StarDict was recognized as a vulnerability (CVE-2009-2260) and access to network dictionaries was disabled by default. Now, this functionality has returned.
Forrás: opennet.ru
