0-click deanonymization attack targeting Signal, Discord, other platforms
1–10 of 474 posts
Re: 0-click deanonymization attack targeting Signal, Discord, other platforms
#2So if you send a picture to a Signal user, it's retrieved via cloudflare, and cached in a data center near that user; now you can look up the cache status and find the data center used. I'd say "deanonymization" is stretching it, unless the user is in the middle of nowhere (no other users near the data center). But interesting writeup anyway.
Re: 0-click deanonymization attack targeting Signal, Discord, other platforms
#3This is quite a detailed write up. I went through the post quickly, but didn’t get why Signal would just download an attachment from an unknown number/contact without first prompting the user to accept or deny the conversation request. I’ve seen conversation requests always waiting for me to accept or not. If I don’t accept, I don’t see any messages on that chat and the other person doesn’t get any indication of message delivery. What have I missed?
If the message is from a known or trusted contact, I think there can be larger problems than just a rough location reveal.
Re: 0-click deanonymization attack targeting Signal, Discord, other platforms
#4This is certainly an "attack" but not one you'd normally associate with zero click. There is no code execution, but some tricks to see which Cloudflare datacenter cached the image -- giving a very rough area the user is in. Impressive and insightful nonetheless.
Re: 0-click deanonymization attack targeting Signal, Discord, other platforms
#5So if you send a picture to a Signal user, it's retrieved via cloudflare, and cached in a data center near that user; now you can look up the cache status and find the data center used. I'd say "deanonymization" is stretching it, unless the user is in the middle of nowhere (no other users near the data center). But interesting writeup anyway.
Indeed, "incredibly precise estimate of the user's location" feels like an exaggeration. But still, very interesting!
Re: 0-click deanonymization attack targeting Signal, Discord, other platforms
#6This is quite a detailed write up. I went through the post quickly, but didn’t get why Signal would just download an attachment from an unknown number/contact without first prompting the user to accept or deny the conversation request. I’ve seen conversation requests always waiting for me to accept or not. If I don’t accept, I don’t see any messages on that chat and the other person doesn’t get any indication of mess…
> didn’t get why Signal would just download an attachment from an unknown number/contact
Usability, most likely. Ultra-secure and paranoid doesn't result in good UX most of the time.
Re: 0-click deanonymization attack targeting Signal, Discord, other platforms
#7This is pretty interesting, and well documented. Great work! I wonder if there is a way to turn off notifications or if the approach is to simply not run such apps.
Re: 0-click deanonymization attack targeting Signal, Discord, other platforms
#8So if you send a picture to a Signal user, it's retrieved via cloudflare, and cached in a data center near that user; now you can look up the cache status and find the data center used. I'd say "deanonymization" is stretching it, unless the user is in the middle of nowhere (no other users near the data center). But interesting writeup anyway.
It gets more interesting when you think about the impact on groups. Sending an image to a group is enough for all devices associated with that group to be identifiable from CloudFlare's side, who additionally see a giant chunk of unencrypted traffic from the same client addresses going to other web sites. Given Cloudflare's less-than-straight approach to sales, it is astonishing the words "secure" and "Signal" ever appear in the same sentence.
CloudFlare get to see a fuckton of metadata from private and group chats, enough to trace who originally sends a piece of media (identifiable from its file size), who reads it, when it is is read, who forwards it and to whom. It really doesn't matter that they can't see an image or video, knowing its size upfront or later (for example in response to a law enforcement request) is enough
Re: 0-click deanonymization attack targeting Signal, Discord, other platforms
#9Presumably cloudfare will close the loophole for enumerating cache edges now.
Re: 0-click deanonymization attack targeting Signal, Discord, other platforms
#10This doesn't strike me as a new 'attack' (I have to imagine there's even a name for such attacks), and 250 miles seems a large radius to 'deanonymize' someone, even a high-value target (even if such people didn't take any other measures to avoid being tracked...)
For reference, here's a 250 mile radius around Toronto Canada https://i.imgur.com/ydpR0IZ.png
