"Luckily" my ISP is DTAG which has horrible peering with Cloudflare.
So I'm routed through Warsaw (WAW) most of the time, even though there are multiple closer datacenters in Germany.
0-click deanonymization attack targeting Signal, Discord, other platforms
201–210 of 474 posts
Re: 0-click deanonymization attack targeting Signal, Discord, other platforms
#202Cool writeup by a 15yo, except for the way it completely oversells in the title. Basically this allowed an attacker to find out which cloudflare data center a victim connected to when being tricked into loading something from cloudflare. This is often within a 250 mile radius of where they're living but not necessarily. Can't one find out someone's IP just as easily by making them make a request to a URL controlled b…
Might even argue that the title is good because it made us click
Re: 0-click deanonymization attack targeting Signal, Discord, other platforms
#203Earlier quoted context omitted.
So, how would you start interacting with your friends if you just created account? >anonymous people Wtf, how is this even relevant?
You can add them by creating a unique, temporary UUIDs/links that they can use? You know them from somewhere else, lets say I play a game and we decided to get into a voice chat. We could create a temporary, dynamically created voice chat that we can all join (much like Google Meet) where all of us are anons. Then, if we really want to know each other, we can then share the UUIDs. I understand why ANYONE can send an…
Adding this level of friction to the process is not viable for a messaging platform whose bread and butter is connecting with friends.
Re: 0-click deanonymization attack targeting Signal, Discord, other platforms
#204Not sure why so many top comments dismiss the severity of this. This is just exactly the type of attack that give law enforcement or a malicious actor a way to establish proof of whereabouts.
Re: 0-click deanonymization attack targeting Signal, Discord, other platforms
#205Earlier quoted context omitted.
It only takes 33 bits to identify someone. This reveals a couple of bits.
Not really. It's only true if the bits are uncorrelated, and you can acquire additional bits of information. I don't see how you can go from "this guy on the internet lives near Albuquerque, New Mexico" to "this guy is Walter Hartwell White, and lives at 308 Negra Arroyo Lane, Albuquerque, New Mexico, 87104" without massive opsec failures.
There is a fun post that explores this idea via an anime called Death Note.
Re: 0-click deanonymization attack targeting Signal, Discord, other platforms
#206I guess signal preview-loading or remote-image-loading features are always going to be usable to identify broadly what region a user is in, using this attack.
Can one disable those features in Signal? Would be annoying becuase they are nice, but yeah.
If you don't want that attack to be able to locate you somewhat (or at least locate your internet endpoint, if you are using a VPN or something), you will need to turn off signal previews and network image displays. Right?
Re: 0-click deanonymization attack targeting Signal, Discord, other platforms
#207Earlier quoted context omitted.
it looks like it can’t be disabled for view-once media (or at least, that’s what the settings screen says)
I wonder if view-once media is even handled the same way as a regular attachment (using CF) or is sent more like a regular message. I imagine if one really wanted it to be view-once, it wouldn't go to a CDN. Thanks for pointing this out!
I think view-once media there means media hosted on signal servers, not remote servers? But not entirely sure.
Re: 0-click deanonymization attack targeting Signal, Discord, other platforms
#208There was mention that the Teleport tool no longer works after the bugfix of the underlying issue (calling other cf locations via Workers and an internal subnet). It seemed like the ability to query which caches HIT on the dye-test image relied on being able to call out to each other DC. Without this control over the route (driving the probing of which caches were hit), the attack would no longer work, right?
There is another method to query the caches. This is mentioned in the article.
Ah, the VPN deployment which probes from various geographies? It has limited coverage (according to author, about 54% of all Cloudflare datacenters) but still a sometimes-working attack, granted.
However, Cloudflare are known for being harsh on VPN exit points and the behavior of requesting the same (unique each pass) image from every geography and then never again, would probably look significantly suspicious, but yeah it seems not to be a priority for cloudflare at the moment.
Re: 0-click deanonymization attack targeting Signal, Discord, other platforms
#209What is the benefit of caching images in a cdn for Signal? Assuming local client-side caching, the total number of requests for that resource should be very small, probably one in the vast majority of cases. On an unrelated note, it seems like CloudFront could very easily fix this by not returning the cf-ray header, or at least having an option for the customer to remove it. Although, it might still be possible to ge…
I dont' believe the Signal app/network is choosing to cacheimages in a CDN?
But any user can send anyone other user a message that includes a link to a CDN-cached resource. Isn't that the "attack" here? Or am I misunderstanding?
Re: 0-click deanonymization attack targeting Signal, Discord, other platforms
#210So if you send a picture to a Signal user, it's retrieved via cloudflare, and cached in a data center near that user; now you can look up the cache status and find the data center used. I'd say "deanonymization" is stretching it, unless the user is in the middle of nowhere (no other users near the data center). But interesting writeup anyway.
It could be useful for correlation. Say for example that you're an investigating agent in regular contact with someone. A single data-point wouldn't mean anything. However, a sequence of daily image retrievals might tell you that they spend 90% of their time in WA and 10% of their time elsewhere. That information alone still might not mean anything, but if you also have a specific suspect in mind, it may help confirm…
you don't have to "befriend" them. you send a friend request because that defaults to a push notification for users with the discord app on their phone. Now, with signal, i don't use it so i don't know how initial chats start, or whatever. The discord one is 0-click because the PFP in the friend request is the payload delivered via PUSH.
And to someone else's point - they had to block the request on their end with a MITM to do the 1-click version on signal. No such MITM is needed with the friend request.
As an aside, one time i got doxxed hard in an IRC channel with several hundred active users. I had a suspicion of who it was, and i knew they lived in chicago. So i "accidentally" sent a link to "screenshot proof" that was hosted on one of my domains. there was 1 immediate click. instant. Chicago. "accidentally" because it looked like i pasted an email body.
Packed the real screenshot and a complaint to the ircadmin. they said "and so you dox them back?"
can't win for trying.