Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

0-click deanonymization attack targeting Signal, Discord, other platforms

gist.github.com

Post reply on HN
Print view View original

121–130 of 474 posts

Re: 0-click deanonymization attack targeting Signal, Discord, other platforms

#121

Post by gruez »

dinosaurdynasty wrote: post #114
internet_points wrote: post #2

So if you send a picture to a Signal user, it's retrieved via cloudflare, and cached in a data center near that user; now you can look up the cache status and find the data center used. I'd say "deanonymization" is stretching it, unless the user is in the middle of nowhere (no other users near the data center). But interesting writeup anyway.

It only takes 33 bits to identify someone. This reveals a couple of bits.

Not really. It's only true if the bits are uncorrelated, and you can acquire additional bits of information. I don't see how you can go from "this guy on the internet lives near Albuquerque, New Mexico" to "this guy is Walter Hartwell White, and lives at 308 Negra Arroyo Lane, Albuquerque, New Mexico, 87104" without massive opsec failures.

Re: 0-click deanonymization attack targeting Signal, Discord, other platforms

#122

Post by 65 »

internet_points wrote: post #2

So if you send a picture to a Signal user, it's retrieved via cloudflare, and cached in a data center near that user; now you can look up the cache status and find the data center used. I'd say "deanonymization" is stretching it, unless the user is in the middle of nowhere (no other users near the data center). But interesting writeup anyway.

I'd say it'd be useful for very specific use cases. Such as finding out what country Jia Tan, the XZ Utils backdoor attacker, is in.

Re: 0-click deanonymization attack targeting Signal, Discord, other platforms

#123

Post by ipaddr »

btown wrote: post #68
thrwaway1985882 wrote: post #30

Earlier quoted context omitted.

"Near a user" is also a big assumption. I'm ~200 miles to ORD and ~500 to IAD, but my ISP's peering & upstream arrangements mean Cloudflare serves my traffic 700 miles from DFW. But, at the same time: Cloudflare isn't going to serve me a cache from Seattle, Manchester, or Tokyo. Pinning down an unknown Signal user to even a rough geographic location is an important bit of metadata that could combine to unmask an indi…

It's also quite insidious as you don't need to control anything on any server to get this information; as long as you can get your target to load a unique URL never before loaded by anyone else, you can simply later poll it with an unauthenticated HTTP GET from different locations, and find which one reports a Cloudflare HIT (or, even if they hid that information, finding the one that returns with lower latency). If…

Going forward uploaded content should never go through cloudflaire and it never really needed to.

Add unique urls.

Maybe just avoid it altogether.

Re: 0-click deanonymization attack targeting Signal, Discord, other platforms

#124

Post by cassepipe »

internet_points wrote: post #2

So if you send a picture to a Signal user, it's retrieved via cloudflare, and cached in a data center near that user; now you can look up the cache status and find the data center used. I'd say "deanonymization" is stretching it, unless the user is in the middle of nowhere (no other users near the data center). But interesting writeup anyway.

I wonder if it'd be a good idea for Signal to implement a "simple" mode that would deactivate most features in order to reduce the attack surface for people who really think they are being targeted. Would that be a good idea ?

Re: 0-click deanonymization attack targeting Signal, Discord, other platforms

#125

Post by udev4096 »

Clever finding but the title does no justice to the actual attack. Even a bare minimum threat model requires a user to use VPN or Tor which completely eliminates your "0day". Signal rightfully declined your report because it's only job is to provide secure communication

Re: 0-click deanonymization attack targeting Signal, Discord, other platforms

#126

Post by gruez »

lxgr wrote: post #119
open-sesame wrote: post #19

Unless I'm missing something, this seems like an incredibly long winded way to check the users IP location? For example, connecting to a VPN and checking https://cloudflare.com/cdn-cgi/trace gives me `colo:CPH` (Copenhagen) which is far from my nearest CF datacenter (geographically), closer to the IP location from my VPN provider (Oslo) but still not particularly close? If I don't use a VPN, I don't even get the capi…

Having your IP address not revealed to people that can message you on Signal seems like a pretty reasonable privacy expectation.

Your IP isn't revealed though, only your vague geographic area.

Re: 0-click deanonymization attack targeting Signal, Discord, other platforms

#127

Post by greysonp »

paulryanrogers wrote: post #16
bigbones wrote: post #8

Earlier quoted context omitted.

It gets more interesting when you think about the impact on groups. Sending an image to a group is enough for all devices associated with that group to be identifiable from CloudFlare's side, who additionally see a giant chunk of unencrypted traffic from the same client addresses going to other web sites. Given Cloudflare's less-than-straight approach to sales, it is astonishing the words "secure" and "Signal" ever a…

I wonder if we'll see assets being padded to some common byte sizes to combat this.

Hi there, Signal dev here. We do, in fact, pad attachments to a limited set of bucket sizes.

Re: 0-click deanonymization attack targeting Signal, Discord, other platforms

#128

Post by gruez »

ziddoap wrote: post #43
open-sesame wrote: post #19

Unless I'm missing something, this seems like an incredibly long winded way to check the users IP location? For example, connecting to a VPN and checking https://cloudflare.com/cdn-cgi/trace gives me `colo:CPH` (Copenhagen) which is far from my nearest CF datacenter (geographically), closer to the IP location from my VPN provider (Oslo) but still not particularly close? If I don't use a VPN, I don't even get the capi…

> just not convinced on the real world applications here... As a piece of data alone, the results are probably not of significant use. The real-world application (and potential danger) is when this data is combined with other data. De-anonymization techniques using sparse datasets has been an active area of research for at least 15 years and it is often surprising to people how much can be gleaned from a few pieces o…

>The real-world application (and potential danger) is when this data is combined with other data. De-anonymization techniques using sparse datasets has been an active area of research for at least 15 years and it is often surprising to people how much can be gleaned from a few pieces of seemingly unconnected data.

Seems pretty handwavy. Can you describe concretely how this would work?

Post reply on HN