Pierluigi Paganini
August 17, 2018
|
Advisory ID:
|
n0sign4l-002
|
Risk level:
|
4 / 5
|
|
Title:
|
Signal Desktop – Recover Expired Messages
|
Credit:
|
Leonardo Porpora – ‘n0sign4l’
|
|
Product:
|
Signal
|
CVE:
|
CVE-2018-14023
|
|
Version:
|
1.14.3 and prior
|
Public Disclosure: 17/08/2018
|
|
|
Vendor:
|
Open Whisper System
|
Signal version 1.14.3 was vulnerable to the recovery of expired messages.
When I reported the vulnerability to the Signal Security Team, its experts fixed it in a very short time, but the fix was partial; in fact version 1.14.4, even though fixed one vulnerability, was still vulnerable to a different attack. I reported the new issue to the security team and version 1.15.0-beta.10 finally addressed the problem.
Everything started from a message that was not cleared from the preview of Signal-Desktop
the message was still there. Messages were stored in the log [I think to double check that they are actually deleted] but they did not clear them with a garbage collector or whatever so I was able to recover them].
The version 1.14.4 fixed this issue but I wanted to try if it was possible to recover messages again from the logs and they were still there. The issue was related to IndexedDB not deleting messages predictably.
Below a video PoC of the vulnerability:
I am very happy to have contributed to the security of Signal, an application that I use every day to talk with my friends, professors…
My contribution was also possible because this is an open-source project and other than just reporting the security hole I had the opportunity to analyze the source code and highlight the flaw.
This is a small example of how effective is the open-source model and I hope everyone can understand the benefits of the community contribution in data protection field so that everybody can provide contributions.
Sorry I can not hear you, there’s interference
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(Security Affairs – Signal, hacking)
[adrotate banner=”5″]
[adrotate banner=”13″]
