Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Signal: Incoming call can be connected without user interaction

bugs.chromium.org

Post reply on HN
Print view View original

21–30 of 35 posts

Re: Signal: Incoming call can be connected without user interaction

#21

Post by bananocurrency »

craftyguy wrote: post #18
josh2600 wrote: post #16

It thrills me to no end that there aren’t a bunch of snarky comments about “OH THIS PROVES SIGNAL IS A TOOL OF THE NSA!!”. Open-source software is great because you can find bugs like this by inspecting the software. Anything that is related to personal communications should be open-source.

> It thrills me to no end that there aren’t a bunch of snarky comments about “OH THIS PROVES SIGNAL IS A TOOL OF THE NSA!!”. There are no such comments here as of this post, or are you lost?

Looks like it's easier for you to be dismissive than it is to comprehend the comment.

Re: Signal: Incoming call can be connected without user interaction

#22

Post by o-__-o »

askmike wrote: post #17
josh2600 wrote: post #16

It thrills me to no end that there aren’t a bunch of snarky comments about “OH THIS PROVES SIGNAL IS A TOOL OF THE NSA!!”. Open-source software is great because you can find bugs like this by inspecting the software. Anything that is related to personal communications should be open-source.

I think open-source software is great as well, but assuming these kind of bugs are found because you can inspect the code is very wishful thinking that doesn't always hold up. This specific example required a Google department to find it. Who would have found it if Google got restrained by the NSA?. Other notable examples include openSSL. On top of that, here is a great talk about how easy it would be to infiltrate o…

Do you know what your app library dependency is doing? They talked about advertising and that got people up in a roar... but what if it’s doing reconnaissance? Mapping out your build and deploy infrastructure because you fetch externally from 12 different locations along your pipeline. Then one day they target a specific company in a patch release and then fix it later. In a high release project you would never know.

Who’s got your back on that?

Re: Signal: Incoming call can be connected without user interaction

#23

Post by loeg »

wolf550e wrote: post #9

Two separate issues: https://bugs.chromium.org/p/project-zero/issues/detail?id=19... webrtc data being handled before call answered, problematic in theory, Moxie can't get webrtc upstream to fix it ( https://twitter.com/moxie/status/1180226374851710976 ), not fixed yet. https://bugs.chromium.org/p/project-zero/issues/detail?id=19... State machine bug in Signal app, you can send the callee the message the caller gets…

> State machine bug in Signal app

Exploitable in the Android Signal app in particular; not the iOS one.

Re: Signal: Incoming call can be connected without user interaction

#24

Post by t34543 »

askmike wrote: post #17
josh2600 wrote: post #16

It thrills me to no end that there aren’t a bunch of snarky comments about “OH THIS PROVES SIGNAL IS A TOOL OF THE NSA!!”. Open-source software is great because you can find bugs like this by inspecting the software. Anything that is related to personal communications should be open-source.

I think open-source software is great as well, but assuming these kind of bugs are found because you can inspect the code is very wishful thinking that doesn't always hold up. This specific example required a Google department to find it. Who would have found it if Google got restrained by the NSA?. Other notable examples include openSSL. On top of that, here is a great talk about how easy it would be to infiltrate o…

What it does mean is that the community can fix it, and you don’t have to divert time from a product approved sprint to fix sec bugs.

Re: Signal: Incoming call can be connected without user interaction

#25

Post by feanaro »

askmike wrote: post #17
josh2600 wrote: post #16

It thrills me to no end that there aren’t a bunch of snarky comments about “OH THIS PROVES SIGNAL IS A TOOL OF THE NSA!!”. Open-source software is great because you can find bugs like this by inspecting the software. Anything that is related to personal communications should be open-source.

I think open-source software is great as well, but assuming these kind of bugs are found because you can inspect the code is very wishful thinking that doesn't always hold up. This specific example required a Google department to find it. Who would have found it if Google got restrained by the NSA?. Other notable examples include openSSL. On top of that, here is a great talk about how easy it would be to infiltrate o…

The fact it's open source enabled someone outside the project to find it in practice. While also possible with closed source software, if you think the bar is possibly too high with an open source project, it is an order of magnitude higher with closed source.

Also, please don't say "Google". A bunch of hackers (on Google's payroll) found it, not Google. We can't tell what would've happened in a counterfactual universe where Google was not financing Project Zero.

Re: Signal: Incoming call can be connected without user interaction

#26

Post by icebraining »

craftyguy wrote: post #19
bArray wrote: post #15

Earlier quoted context omitted.

Thank you, why absolutely no text can be displayed without JS enabled is beyond me. The page source is filled to the brim with trackers.

> The page source is filled to the brim with trackers. I would expect nothing less from a site owned by google.

On the contrary; on a site owned by Google (or any other tracking company), I expect there to be only their own tracker(s), unlike on most other commercial sites, where there are often dozens.

And the requests I see seem to indicate just that: it only tried to load Google Analytics.

Re: Signal: Incoming call can be connected without user interaction

#27

Post by newscracker »

t34543 wrote: post #24
askmike wrote: post #17

Earlier quoted context omitted.

I think open-source software is great as well, but assuming these kind of bugs are found because you can inspect the code is very wishful thinking that doesn't always hold up. This specific example required a Google department to find it. Who would have found it if Google got restrained by the NSA?. Other notable examples include openSSL. On top of that, here is a great talk about how easy it would be to infiltrate o…

What it does mean is that the community can fix it, and you don’t have to divert time from a product approved sprint to fix sec bugs.

It's also ironic that the community fixing something for a security issue isn't going to help much since almost all the users rely on the app stores (Play Store in this case, since it seems like this is Android specific) for updates and wouldn't get any fixes unless they're tech savvy or until the developer (Signal) pushes the update to the Play Store and Google approves it.

Re: Signal: Incoming call can be connected without user interaction

#28

Post by thinkbud »

wolf550e wrote: post #9

Two separate issues: https://bugs.chromium.org/p/project-zero/issues/detail?id=19... webrtc data being handled before call answered, problematic in theory, Moxie can't get webrtc upstream to fix it ( https://twitter.com/moxie/status/1180226374851710976 ), not fixed yet. https://bugs.chromium.org/p/project-zero/issues/detail?id=19... State machine bug in Signal app, you can send the callee the message the caller gets…

Deja Vu.

> you can send the callee the message the caller gets when the callee answers

This is the exact same type of bug that was in libssh: https://www.nccgroup.trust/uk/our-research/technical-advisor...

"possible to bypass authentication by presenting to the server an SSH2_MSG_USERAUTH_SUCCESS message in place of the SSH2_MSG_USERAUTH_REQUEST message which the server would expect to initiate authentication"

Also, Apple had a FaceTime bug of very similar nature:

https://www.theverge.com/2019/1/28/18201383/apple-facetime-b...

"you begin calling somebody via FaceTime Video from within the Phone app. Before that person picks up, you can swipe up to add your own phone number to the call. Once you’ve added yourself, FaceTime immediately seems to assume it’s an active conference call and begins sending the audio of the person you’re calling"

Re: Signal: Incoming call can be connected without user interaction

#29

Post by gretch »

feanaro wrote: post #25
askmike wrote: post #17

Earlier quoted context omitted.

I think open-source software is great as well, but assuming these kind of bugs are found because you can inspect the code is very wishful thinking that doesn't always hold up. This specific example required a Google department to find it. Who would have found it if Google got restrained by the NSA?. Other notable examples include openSSL. On top of that, here is a great talk about how easy it would be to infiltrate o…

The fact it's open source enabled someone outside the project to find it in practice. While also possible with closed source software, if you think the bar is possibly too high with an open source project, it is an order of magnitude higher with closed source. Also, please don't say "Google". A bunch of hackers (on Google's payroll) found it, not Google. We can't tell what would've happened in a counterfactual univer…

I’m shocked at how cynical your perspective is that you don’t grant credit here.

Like if I said “the police didn’t save me from the hostage situation. Some hero saved me who happened to be working for the police. In an alternate universe we don’t where this guy isn’t employed by the police, we don’t know if he wouldn’t have saved me anyway”

Can’t you just say, thanks police, you saved me.

Re: Signal: Incoming call can be connected without user interaction

#30

Post by feanaro »

gretch wrote: post #29
feanaro wrote: post #25

Earlier quoted context omitted.

The fact it's open source enabled someone outside the project to find it in practice. While also possible with closed source software, if you think the bar is possibly too high with an open source project, it is an order of magnitude higher with closed source. Also, please don't say "Google". A bunch of hackers (on Google's payroll) found it, not Google. We can't tell what would've happened in a counterfactual univer…

I’m shocked at how cynical your perspective is that you don’t grant credit here. Like if I said “the police didn’t save me from the hostage situation. Some hero saved me who happened to be working for the police. In an alternate universe we don’t where this guy isn’t employed by the police, we don’t know if he wouldn’t have saved me anyway” Can’t you just say, thanks police, you saved me.

I just prefer congratulating the actual people that did this instead of the relatively arbitrary money supplier. You could say I'm equally shocked that credit is propagated as "Google" instead of the names of the researchers.
Post reply on HN