TeamSpeak 3 Security Awareness

[Kieran]

I’m considering making a tutorial on setting it up. Hell, we could probably just package an image for people so it comes preinstalled/packaged with TS3 and a shortcut.

Do you have a picture of it working?

Would be an idea to try.

Yea, it's great. No need to set up anything. It automatically accepted my USB mic without having to change any settings

 

[Jackbox]

Would be an idea to try.

Yea, it's great. No need to set up anything. It automatically accepted my USB mic without having to change any settings

It’s free too! Wow that’s awesome man, I’ve not used Oracle’s VirtualBox in a while. I’ll definitely make a tutorial on setup a little later today

 

[lightsol]

I guess that leaves us with only voice detection being available, without being able to use PTT sadly.
Very well done though, its rare to see people provide proper examples regarding these kind of issues.

 

[Asphyxia]

I guess that leaves us with only voice detection being available, without being able to use PTT sadly.
Very well done though, its rare to see people provide proper examples regarding these kind of issues.

That is somewhat correct lightsol. The only other way I know would be to install a virtual KVM software which many are documented over here. This could involve toggling input focus between two systems which could be annoying but possible. I would have to research further but perhaps there is a way to configure it so only "Ctrl + F8" is sent to both machines or another key combination. This would obviously solve the problem we are facing here. If not, surely there must be a way to make this possible with the open source Synergy/Symless if someone cares to solve this specific problem.

The idea behind the virtual KVM is it enables sharing mouse/keyboard input between both machines. I favor open source solutions for obvious security reasons, you may compile Synergy (renamed Symless) yourself: https://github.com/symless/synergy-core but compiling it yourself is optional. Use your best judgment in terms of downloading software solutions. <3

I see another solution though lightsol. Why not keep voice activation on and on the host machine toggle the host machine's microphone input off and on (example: set mic input volume to 0, and toggle it between 90 and 0).. or however best works. I am willing to make such software for free an open source if desired.

It would be basically the same as push to talk, just a different way to solve the problem. On key up from a hotkey, mic volume could go to 0 whereas when the keys are pressed, mic volume could go to 90. I am not positive entirely if this would solve the problem but surely there must be a way to solve this to enable push-to-talk or something similar. If anyone can think of a better solution to the problem, please chime in.

 

[Kieran]

So, I poked Chris about the outdate Qt and virtualization of the client.
He said, quote, "We have something in the pipeline, but nothing I'd be allowed to talk about. Something big."
That's the only info I got so I hope it was related to the security concerns and not just a general "Ye boi we got features comin to calm u down fam"

 

[Jackbox]

So, I poked Chris about the outdate Qt and virtualization of the client.
He said, quote, "We have something in the pipeline, but nothing I'd be allowed to talk about. Something big."
That's the only info I got so I hope it was related to the security concerns and not just a general "Ye boi we got features comin to calm u down fam"

If they’re not doing a proper security audit, it might be big like the titanic lol

 

[Smoku]

Meh I don’t understand like half of the words you use ;_; I’m from Poland and I want to learn programming but...

 

[Kieran]

If they’re not doing a proper security audit, it might be big like the titanic lol

LOL. Good one.

About hotkeys.. Wouldn't it be possible to solve that problem using the client query? I'm not sure if that would solve @lightsol 's problem, but it would make things easier for setting up mute keys and such, right?

 

[Kieran]

Meh I don’t understand like half of the words you use ;_; I’m from Poland and I want to learn programming but...

I'd say what Asphyxia is talking about is a rather high level of programming and not really a recommended approach for a beginner.
He's basically talking about that teamspeak can be used by a bad person to harm your computer, because teamspeak has many security flaws. That's why he was talking about virtual machines.
What else were you not able to understand?

 

[Smoku]

I'd say what Asphyxia is talking about is a rather high level of programming and not really a recommended approach for a beginner.
He's basically talking about that teamspeak can be used by a bad person to harm your computer, because teamspeak has many security flaws. That's why he was talking about virtual machines.
What else were you not able to understand?

I mean ye I understand that but for example “remote execution” :v

Btw. Where should I start Im now 9th grade and I need to chose next school, I chosed computer and communication course, I’m learning C++ rn but do you have some tips? (I know I shouldn’t write it here, sorry)

 

[Kieran]

I mean ye I understand that but for example “remote execution” :v

Btw. Where should I start Im now 9th grade and I need to chose next school, I chosed computer and communication course, I’m learning C++ rn but do you have some tips? (I know I shouldn’t write it here, sorry)

"remote code execution" means executing code on a machine that is not around you. Similar to when you send a command to a server via ssh.
When talking about RCE, people often mean it in a malicious way like @Asphyxia explained in his other posts. An attacker could use a flaw in teamspeak to execute something bad on your computer.

If you're learning c++ in school then continue with that for a while until you finish the topic in school. When you have questions or aren't sure about something, always ask the teacher. Use the opportunity that you have somebody that knows what they are teaching.
Once you know how to do little things in c++ yourself, you'll be able to learn other languages much faster. Maybe look into html, css, javascript and php after that. You can do some fun things with that and web applications are getting more and more popular.

 

[Jackbox]

but for example “remote execution”

Read here: https://en.wikipedia.org/wiki/Arbitrary_code_execution

In computer security, "arbitrary code execution" is used to describe an attacker's ability to execute any command of the attacker's choice on a target machine or in a target process. It is commonly used in arbitrary code execution vulnerability to describe a software bug that gives an attacker a way to execute arbitrary code. A program that is designed to exploit such a vulnerability is called an arbitrary code execution exploit. Most of these vulnerabilities allow the execution of machine code and most exploits therefore inject and execute shellcode to give an attacker an easy way to manually run arbitrary commands. The ability to trigger arbitrary code execution from one machine on another (especially via a wide-area network such as the Internet) is often referred to as remote code execution.

Exactly as Kieran explained

 

[Smoku]

"remote code execution" means executing code on a machine that is not around you. Similar to when you send a command to a server via ssh.
When talking about RCE, people often mean it in a malicious way like @Asphyxia explained in his other posts. An attacker could use a flaw in teamspeak to execute something bad on your computer.

If you're learning c++ in school then continue with that for a while until you finish the topic in school. When you have questions or aren't sure about something, always ask the teacher. Use the opportunity that you have somebody that knows what they are teaching.
Once you know how to do little things in c++ yourself, you'll be able to learn other languages much faster. Maybe look into html, css, javascript and php after that. You can do some fun things with that and web applications are getting more and more popular.

Em I’m not learning C++ in school, I’m learning myself right now. I’m gonna go highschool next year :v (I’m in Sweden btw)

 

[Kieran]

Em I’m not learning C++ in school, I’m learning myself right now. I’m gonna go highschool next year :v (I’m in Sweden btw)

Oh, alright. I think c# would be easier for a beginner.

 

[Smoku]

Oh, alright. I think c# would be easier for a beginner.

I mean, for me C++ looks cleaner :v

 

[Kieran]

@Jackbox about the tutorial:
Create a "teamspeak.desktop" file in .config/autostart/ (relative to the home dir of the user running TS) and put this in it:

Spoiler

[Desktop Entry]
Name=TeamSpeakLauncher
GenericName=TeamSpeak Launcher
Comment=TeamSpeak Launcher
Exec=/root/Desktop/teamspeak/ts3client_runscript.sh
Terminal=false
Type=Application
X-GNOME-Autostart-enabled=true

This will make TS launch when the user logs in. Don't forget to change the Exec path to the ts3 runscript tho.

 

[Asphyxia]

This will make TS launch when the user logs in

Do you know of the best way to package this together so it is literally packaged for the user to click and open the virtual system (ready to run) with VirtualBox. I will play around with VirtualBox to see if we can just package this for users, so they turn it on and are looking at TeamSpeak. This would be so incredibly convenient for users and obviously requires they trust us some, but that is okay with me if people have to trust us in return for them being safer regarding separating TeamSpeak from all their keepsakes like family photos or important bank information, etc.

I will do my best to create the virtual machine tonight in class (cyber security college classes).

 

[Kieran]

Do you know of the best way to package this together so it is literally packaged for the user to click and open the virtual system (ready to run) with VirtualBox.

Hm, you mean without an actual OS running TS visible? I don't know how to do that, but just exporting the VM is really easy and can be imported by just drag and dropping the file. The only additional thing for "automating" this process that I can think of is autologin as a user without a password which has the teamspeak.desktop in their autostart dir. Then they would only have to click "Start" in VB and wait.
This can be done by editing /etc/gdm3/daemon.conf. Uncomment "AutomaticLoginEnable = true" and "AutomaticLogin = root" and kali should automatically start logged in as root and start teamspeak (if its set up in .config/autostart)
(Kinda have the feeling that part of my english just died in this post but shhh dont judge me, I'm really tired and about to go to bed)

https://puu.sh/yb5cB.mp4

There is also this weird... bug? that turns down the volume and sets the balance of the second output device to far right. I'm not sure what that is yet but it could be that I f*ed something up myself and not an error in kali itself.

Spoiler

Maybe not? Idk still observing.
Also, just noticed, might also just be something wrong with my personal VM, the mic volume turns down even though the bar is full. To fix this you just gotta turn it down and the turn it up again.
https://puu.sh/yb5Rt.mp4

 

[Asphyxia]

Hm, you mean without an actual OS running TS visible? I don't know how to do that, but just exporting the VM is really easy and can be imported by just drag and dropping the file. The only additional thing for "automating" this process that I can think of is autologin as a user without a password which has the teamspeak.desktop in their autostart dir. Then they would only have to click "Start" in VB and wait.
This can be done by editing /etc/gdm3/daemon.conf. Uncomment "AutomaticLoginEnable = true" and "AutomaticLogin = root" and kali should automatically start logged in as root and start teamspeak (if its set up in .config/autostart)
(Kinda have the feeling that part of my english just died in this post but shhh dont judge me, I'm really tired and about to go to bed)

https://puu.sh/yb5cB.mp4

There is also this weird... bug? that turns down the volume and sets the balance of the second output device to far right. I'm not sure what that is yet but it could be that I f*ed something up myself and not an error in kali itself.

Spoiler

Maybe not? Idk still observing.
Also, just noticed, might also just be something wrong with my personal VM, the mic volume turns down even though the bar is full. To fix this you just gotta turn it down and the turn it up again.
https://puu.sh/yb5Rt.mp4

It could be some sort of an auto-volume-adjuster perhaps in mic input settings somewhere or something.

I just used VMware Workstation Pro with Linux Mint. It works perfectly, I also tried turning it into an OVF or something --- no luck.

I generated an OVF but it comes up as corrupt in VirtualBox. Surely making a VM with TS3 ready to go when someone loads it up should not be hard, I am not sure why I cannot get this to work.

I will keep trying to package something together for a download/run TS3 virtualization. I guess we could just give them an sh to run when they boot their Linux of choice. SH could fetch required files and setup the configs you mentioned.

 

[velvinv]

they need to fix their shit or open source it so we can fix it for them