Advisory ID: | n0sign4l-002 | Risk level: | 4 / 5 |
Title: | Signal Desktop – Recover Expired Messages | Credit: | Leonardo Porpora – ‘n0sign4l’ |
Product: | Signal | CVE: | CVE-2018-14023 |
Version: | 1.14.3 and prior | Public Disclosure: 17/08/2018 | |
Vendor: | Open Whisper System |
Signal version 1.14.3 was vulnerable to the recovery of expired messages.
When I reported the vulnerability to the Signal Security Team, its experts fixed it in a very short time, but the fix was partial; in fact version 1.14.4, even though fixed one vulnerability, was still vulnerable to a different attack. I reported the new issue to the security team and version 1.15.0-beta.10 finally addressed the problem.
Everything started from a message that was not cleared from the preview of Signal-Desktop
The version 1.14.4 fixed this issue but I wanted to try if it was possible to recover messages again from the logs and they were still there. The issue was related to IndexedDB not deleting messages predictably.
Below a video PoC of the vulnerability:
I am very happy to have contributed to the security of Signal, an application that I use every day to talk with my friends, professors…
My contribution was also possible because this is an open-source project and other than just reporting the security hole I had the opportunity to analyze the source code and highlight the flaw.
This is a small example of how effective is the open-source model and I hope everyone can understand the benefits of the community contribution in data protection field so that everybody can provide contributions.
Sorry I can not hear you, there’s interference
[adrotate banner=”9″] | [adrotate banner=”12″] |
(Security Affairs – Signal, hacking)
[adrotate banner=”5″]
[adrotate banner=”13″]
Oracle confirms a cloud data breach, quietly informing customers while downplaying the impact of the…
Security Affairs Malware newsletter includes a collection of the best articles and research on malware…
A new round of the weekly SecurityAffairs newsletter arrived! Every week the best security articles…
A researcher used ChatGPT-4o to create a replica of his passport in just five minutes,…
A now-patched flaw in Verizon ’s iOS Call Filter app exposed call records of millions.…
Port of Seattle is notifying 90,000 people of a data breach after personal data was…
This website uses cookies.