Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

0-click deanonymization attack targeting Signal, Discord, other platforms

gist.github.com

Post reply on HN
Print view View original

111–120 of 474 posts

Re: 0-click deanonymization attack targeting Signal, Discord, other platforms

#111

Post by gruez »

AnonC wrote: post #3

This is quite a detailed write up. I went through the post quickly, but didn’t get why Signal would just download an attachment from an unknown number/contact without first prompting the user to accept or deny the conversation request. I’ve seen conversation requests always waiting for me to accept or not. If I don’t accept, I don’t see any messages on that chat and the other person doesn’t get any indication of mess…

>I went through the post quickly, but didn’t get why Signal would just download an attachment from an unknown number/contact without first prompting the user to accept or deny the conversation request.

Where are you getting the impression that signal auto-downloads attachments from an unknown number/contact? The OP says there's auto-download, but not that it happens from unknown contacts.

Re: 0-click deanonymization attack targeting Signal, Discord, other platforms

#112

Post by [deleted] »

SahAssar wrote: post #105
powerhugs wrote: post #39

For being 15 year old, cool work! But calling this de-anonymization is a stretch, if it can possibly pinpoint you within 250 miles (that's assuming geoip is correct too, which it rarely is). In their GeoGuesser demonstration video, the higlighted area is densely populated and you still would need to match millions of people vs the online user. It does provide some hints as to the location of the targeted user, and th…

> assuming geoip is correct too It's not using geoip, it's using anycast.

[deleted]

Re: 0-click deanonymization attack targeting Signal, Discord, other platforms

#113

Post by vel0city »

LWIRVoltage wrote: post #103
alp1n3_eth wrote: post #63

Earlier quoted context omitted.

Thank you! That's what I get for quick scrolling through the settings. I for sure thought it would have been under Privacy (for this concern), but that makes sense too.

So, just to confirm my understanding, if one goes into those settings and disables all auto-download, that helps- but, then a user will manually download images, correct? Are they still vulnerable to this issue then at that time?

A user might download images and yes, if they download images Cloudflare will show which datacenters have cached that image. They might also install an APK you give them or run that taylor_swift_concert.mp4.exe as well.

If I host an image on Cloudflare and put the URL here, I'll know which CF datacenters are near HN users who bother clicking the link as well.

Re: 0-click deanonymization attack targeting Signal, Discord, other platforms

#114

Post by dinosaurdynasty »

internet_points wrote: post #2

So if you send a picture to a Signal user, it's retrieved via cloudflare, and cached in a data center near that user; now you can look up the cache status and find the data center used. I'd say "deanonymization" is stretching it, unless the user is in the middle of nowhere (no other users near the data center). But interesting writeup anyway.

It only takes 33 bits to identify someone. This reveals a couple of bits.

Re: 0-click deanonymization attack targeting Signal, Discord, other platforms

#115

Post by vel0city »

yapyap wrote: post #32

> it's possible for an attacker to run a cache geolocation attack to find out which local datacenter they're near--similar to how law enforcement track mobile devices through cell phone towers. very much disagree on this, they track mobile devices through your connection strength to multiple cellular towers while this attack proves which singular datacenter the victim is nearest. Don’t get me wrong the write up is re…

> through cell phone towers

Extremely sensationalist. A cell tower might have a range of a few miles, max. This is giving ranges of 250+mi.

Re: 0-click deanonymization attack targeting Signal, Discord, other platforms

#116

Post by Mystery-Machine »

Why does CloudFlare return whether it was a cache hit or miss? This information could be hidden/removed. I understand it's not a complete solution of the issue, because cached responses will return much faster than non-cached ones, but it's a step in the right direction.

Re: 0-click deanonymization attack targeting Signal, Discord, other platforms

#117

Post by gruez »

gobip wrote: post #12

"Signal instantly dismissed my report" "Telegram, another privacy-focused application, is completely invulnerable to this attack" "Discord […] citing this as a Cloudflare issue other consumers are also vulnerable to" "Cloudflare ended up completing patching the bug" I wish Signal would react differently. I still remember the bubble color controversy when they changed their mind after the backlash and not before. :-)

>"Signal instantly dismissed my report"

>I wish Signal would react differently. I still remember the bubble color controversy when they changed their mind after the backlash and not before. :-)

Can you blame them though? They're a non-profit with limited manpower and resources. There's quite a lot of cranks in the security field, and as many people have echoed in this thread, the bug report is rather sensationalist. At some point you just have to pattern match and ignore any reports that seems a bit too cranky. Is this ideal? No. But I don't see how it's any different than summarily dismissing a vaccine skeptic's claim that vaccines are bad, even if there's a kernel of truth buried in there (eg. that benefits for young people are questionable).

Re: 0-click deanonymization attack targeting Signal, Discord, other platforms

#118

Post by mapcars »

yapyap wrote: post #32

> it's possible for an attacker to run a cache geolocation attack to find out which local datacenter they're near--similar to how law enforcement track mobile devices through cell phone towers. very much disagree on this, they track mobile devices through your connection strength to multiple cellular towers while this attack proves which singular datacenter the victim is nearest. Don’t get me wrong the write up is re…

While the detection area of the cloudflare attack is bigger I think the main problem here is that its much easier to get access to it than to cellphone towers.

Re: 0-click deanonymization attack targeting Signal, Discord, other platforms

#119

Post by lxgr »

open-sesame wrote: post #19

Unless I'm missing something, this seems like an incredibly long winded way to check the users IP location? For example, connecting to a VPN and checking https://cloudflare.com/cdn-cgi/trace gives me `colo:CPH` (Copenhagen) which is far from my nearest CF datacenter (geographically), closer to the IP location from my VPN provider (Oslo) but still not particularly close? If I don't use a VPN, I don't even get the capi…

Having your IP address not revealed to people that can message you on Signal seems like a pretty reasonable privacy expectation.

Re: 0-click deanonymization attack targeting Signal, Discord, other platforms

#120

Post by cesarb »

It seems to me that a key requirement for this attack is that both the attacker and the victim load the same link, that is, that the attacker knows the URL the victim is going to load. If Signal/Discord created a different link to be given to the victim, and never shared it with the attacker, this attack wouldn't work.

That could be as simple as adding some extra pseudo-random parameters to the URL which will be ignored by the origin (but honored by the caches), or as complex as creating a completely separate URL for the receiver of the message, and somehow giving it to the receiver without giving it to the sender (easy on Discord, harder on Signal due to its end-to-end nature).

Post reply on HN