Do you use the Lychee Slicer? It seems there is a security issue with the software.
Lychee Slicer is a product of Mango3D. It’s one of the few third-party slicing tools for 3D printing — most slicers are directly associated with the 3D printer manufacturer. Although Mango3D does provide a free “Lite” version, they support the product with paid subscriptions for access to more advanced features.
Because of the subscription feature, you must sign into the slicer to make use of it.
The security issue was found by “JollyOrc” during an account email change situation. They write:
“A month ago, I found a way to take over any Mango3D customer account, provided you know their name and account email address, maybe also their country.”
The process of changing an email is usually a bit tricky in any service, but it is unusual how Mango3D executes the process. According to JollyOrc, a form is sent to the company requesting the change, and the proof of ownership of the account is done by attaching a simple screenshot of the account’s dashboard window.
The problem is that the dashboard is trivial in design and incredibly easy to mock up. All you’d need to know is the account’s email and customer name, and perhaps the country as well. There would be no way for anyone at the Mango3D end to know whether the screenshot was real or fake.
If a bad actor followed this approach, they’d gain access to the victim’s account and therefore any files present. Lychee Slicer plans offer both cloud and local backups, so presumably the cloud backups could then be accessed. This means that print jobs could be exposed, and in some cases that could be very bad news.
JollyOrc said that they had notified Mango3D at the end of July, but have seen no evidence that the problem is fixed or even whether a fix process has started. Because of that, they decided to publicly release news of the problem.
I’m hoping that Mango3D does acknowledge the issue and fixes it straight away.
Via Orkpiraten and Lychee
