0-click deanonymization attack targeting Signal, Discord, other platforms • Hacker News Board

Re: 0-click deanonymization attack targeting Signal, Discord, other platforms

#131

Post by layer8 » Tue, Jan 21, 2025, 5:14 PM UTC

cesarb wrote: post #120

It seems to me that a key requirement for this attack is that both the attacker and the victim load the same link, that is, that the attacker knows the URL the victim is going to load. If Signal/Discord created a different link to be given to the victim, and never shared it with the attacker, this attack wouldn't work. That could be as simple as adding some extra pseudo-random parameters to the URL which will be igno…

Since creating separate URLs would largely defeat the purpose of caching, a simpler solution would be to just disable caching, as Cloudflare suggested in their response.

Re: 0-click deanonymization attack targeting Signal, Discord, other platforms

#132

Post by udev4096 » Tue, Jan 21, 2025, 5:16 PM UTC

lxgr wrote: post #119

open-sesame wrote: post #19

Unless I'm missing something, this seems like an incredibly long winded way to check the users IP location? For example, connecting to a VPN and checking https://cloudflare.com/cdn-cgi/trace gives me `colo:CPH` (Copenhagen) which is far from my nearest CF datacenter (geographically), closer to the IP location from my VPN provider (Oslo) but still not particularly close? If I don't use a VPN, I don't even get the capi…

Having your IP address not revealed to people that can message you on Signal seems like a pretty reasonable privacy expectation.

Did you even read it? There's no IP leak. And if you're a high target, then using some kind of proxy is literally the first step you take. The attack is nothing but an exaggeration and has no merit in real world

Re: 0-click deanonymization attack targeting Signal, Discord, other platforms

#133

Post by lxgr » Tue, Jan 21, 2025, 5:17 PM UTC

gruez wrote: post #126

lxgr wrote: post #119

Earlier quoted context omitted.

Having your IP address not revealed to people that can message you on Signal seems like a pretty reasonable privacy expectation.

Your IP isn't revealed though, only your vague geographic area.

That's marginally better, but can still be a problem. Just consider e.g. a whistleblower working for a company with a very small satellite office in a given country.

Re: 0-click deanonymization attack targeting Signal, Discord, other platforms

#134

Post by [deleted] » Tue, Jan 21, 2025, 5:18 PM UTC

thrwaway1985882 wrote: post #30

internet_points wrote: post #2

So if you send a picture to a Signal user, it's retrieved via cloudflare, and cached in a data center near that user; now you can look up the cache status and find the data center used. I'd say "deanonymization" is stretching it, unless the user is in the middle of nowhere (no other users near the data center). But interesting writeup anyway.

"Near a user" is also a big assumption. I'm ~200 miles to ORD and ~500 to IAD, but my ISP's peering & upstream arrangements mean Cloudflare serves my traffic 700 miles from DFW. But, at the same time: Cloudflare isn't going to serve me a cache from Seattle, Manchester, or Tokyo. Pinning down an unknown Signal user to even a rough geographic location is an important bit of metadata that could combine to unmask an indi…

[deleted]

Re: 0-click deanonymization attack targeting Signal, Discord, other platforms

#135

Post by lxgr » Tue, Jan 21, 2025, 5:19 PM UTC

udev4096 wrote: post #132

lxgr wrote: post #119

Earlier quoted context omitted.

Having your IP address not revealed to people that can message you on Signal seems like a pretty reasonable privacy expectation.

Did you even read it? There's no IP leak. And if you're a high target, then using some kind of proxy is literally the first step you take. The attack is nothing but an exaggeration and has no merit in real world

Yes, I read it. Information about your IP address is leaked, as that's how Cloudflare routes you to a given datacenter.

And I strongly disagree that being able to uncover somebody's rough geographic location is not a privacy problem.

I wouldn't be surprised if this, for example, lets you deduce if somebody is currently home, at work, or commuting (as all three ISPs might be hitting different Cloudflare datacenters). That's not information everybody is comfortable broadcasting to the world.

Re: 0-click deanonymization attack targeting Signal, Discord, other platforms

#136

Post by redcobra762 » Tue, Jan 21, 2025, 5:20 PM UTC

some_furry wrote: post #38

yapyap wrote: post #32

> it's possible for an attacker to run a cache geolocation attack to find out which local datacenter they're near--similar to how law enforcement track mobile devices through cell phone towers. very much disagree on this, they track mobile devices through your connection strength to multiple cellular towers while this attack proves which singular datacenter the victim is nearest. Don’t get me wrong the write up is re…

> Don’t get me wrong the write up is really interesting but it does feel like the author is a bit of a sensationalist. They claim to be 15 years old. Cut them some slack.

No.

Re: 0-click deanonymization attack targeting Signal, Discord, other platforms

#137

Post by udev4096 » Tue, Jan 21, 2025, 5:20 PM UTC

anon-3988 wrote: post #18

Tepix wrote: post #11

Congrats on finding this. Very impressive for a 15-year-old! The section "How to Protect Yourself" is lacking. Step 1. Don't receive this information in the push message. Only send the fact that there is something waiting for you in the app. Chances are there are other vulnerabilities that compromise the end-to-end encryption guarantees provided by the app (and only by the app). In Signal on iOS: Click on your icon i…

Step 2: If you use Discord, don't allow invites from _anyone_. Its quite bizarre why social media apps allow anonymous people to interact with you. 99% of the conversation I have is with people that I roughly know.

Just don't use it. Expecting privacy and security from a literal keylogger. Who in their right mind uses a plain-text messaging app in 2025?

Re: 0-click deanonymization attack targeting Signal, Discord, other platforms

#138

Post by gruez » Tue, Jan 21, 2025, 5:21 PM UTC

immibis wrote: post #56

xnorswap wrote: post #24

Earlier quoted context omitted.

It could be useful for correlation. Say for example that you're an investigating agent in regular contact with someone. A single data-point wouldn't mean anything. However, a sequence of daily image retrievals might tell you that they spend 90% of their time in WA and 10% of their time elsewhere. That information alone still might not mean anything, but if you also have a specific suspect in mind, it may help confirm…

There's probably at least a few instances where you send someone you think is American a picture but it gets cached in Moscow, or vice versa. Or you post a meme to a Californian left-wing group and it gets cached in DC. Not hard to imagine situations where getting an unexpected rough location could be a valuable signal.

>Or you post a meme to a Californian left-wing group and it gets cached in DC. Not hard to imagine situations where getting an unexpected rough location could be a valuable signal.

Not really. Any public meme group is inevitably going to be monitored by intelligence agencies, and you should assume as such. Even if it isn't, I can imagine agitators from the other side joining the group with a Russian VPN to poison the well. If there's a private group of people that you supposedly trust, any competent mole is going to be using device/network level VPN to cover their tracks. Otherwise they're 1 click away (eg. if someone shared a link) from an opsec fail.

Re: 0-click deanonymization attack targeting Signal, Discord, other platforms

#139

Post by zild3d » Tue, Jan 21, 2025, 5:23 PM UTC

open-sesame wrote: post #19

Unless I'm missing something, this seems like an incredibly long winded way to check the users IP location? For example, connecting to a VPN and checking https://cloudflare.com/cdn-cgi/trace gives me `colo:CPH` (Copenhagen) which is far from my nearest CF datacenter (geographically), closer to the IP location from my VPN provider (Oslo) but still not particularly close? If I don't use a VPN, I don't even get the capi…

> Unless I'm missing something, this seems like an incredibly long winded way to check the users IP location?

It's less accurate than that. IP Geocoding can be down to the city level in many cases. This is _maybe_ nearest cloudflare data center

Re: 0-click deanonymization attack targeting Signal, Discord, other platforms

#140

Post by thayne » Tue, Jan 21, 2025, 5:23 PM UTC

What is the benefit of caching images in a cdn for Signal?

Assuming local client-side caching, the total number of requests for that resource should be very small, probably one in the vast majority of cases.

On an unrelated note, it seems like CloudFront could very easily fix this by not returning the cf-ray header, or at least having an option for the customer to remove it. Although, it might still be possible to get that information based on timing information...