Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

0-click deanonymization attack targeting Signal, Discord, other platforms

gist.github.com

Post reply on HN
Print view View original

231–240 of 474 posts

Re: 0-click deanonymization attack targeting Signal, Discord, other platforms

#231

Post by gtsop »

byearthithatius wrote: post #223
lxe wrote: post #204

Not sure why so many top comments dismiss the severity of this. This is just exactly the type of attack that give law enforcement or a malicious actor a way to establish proof of whereabouts.

I would guess some are just jealous of his age, but some do find the claim of de anonymizing to simply be overblown given it doesn't tell you nearly enough to find anyone except in very niche cases. This "attack" is easily defeated with a VPN or living in any major city.

Interesting you touched on his age. I got extremely curious, why did the OP did such a flex?(assumming they are telling the truth). The first sentence is such a weird brag that it felt suspicious. The report is highly technical and extremely well written. We're either dealing with a pure genious or a fraud. But why would a genious flex? Doesn't make sense.

Re: 0-click deanonymization attack targeting Signal, Discord, other platforms

#232

Post by ipaddr »

gabeio wrote: post #215
ipaddr wrote: post #123

Earlier quoted context omitted.

Going forward uploaded content should never go through cloudflaire and it never really needed to. Add unique urls. Maybe just avoid it altogether.

> Going forward uploaded content should never go through cloudflaire and it never really needed to. The problem in this case isn't cloudflare. The problem is that these images load without the user's interaction and the person sending it gets to choose if it's cloudflare or not. So your statement within this context doesn't really work.

Would removing cloudflare fix the issue? Then the problem is cloudflare related.

Your defense doesn't really work. Sure many entities could share blame but the one fix is getting rid of cloudflare.

Re: 0-click deanonymization attack targeting Signal, Discord, other platforms

#233

Post by modeless »

sureIy wrote: post #221
modeless wrote: post #191

Earlier quoted context omitted.

Also the attack can be performed multiple times and if a person travels it could narrow down the possibilities quite a lot.

Let's say they travel between NY and LA, how many sources of data will you need to know who was in NY on a specific date and LA on a second date? Feels like only the government can reasonably locate that.

The government is a plausible adversary for Signal

Re: 0-click deanonymization attack targeting Signal, Discord, other platforms

#234

Post by kelnos »

Why has Signal even enabled caching for those URLs? The most common case is going to be that the attachment is downloaded once, and that's it.

I would even expect that Signal wouldn't allow you to download it more than once, and would immediately delete it after the first successful download. Well, ok, maybe the client fails mid-way through, so allow some grace period for a re-download. But I can't imagine that would be the common case either, and so disabling caching on their CDN would fix this issue, and hopefully not increase their costs much.

At any rate, "deanonymization" is a bit clickbaity here. Narrowing someone's location to within 250 miles or so isn't great, but it doesn't deanonymize them.

Edit: I didn't think about the case where an attachment is sent to a group chat, where multiple people will be downloading it. But in that case wouldn't the attachment be encrypted individually for each person in the group? I'm not sure how this works, of course.

Re: 0-click deanonymization attack targeting Signal, Discord, other platforms

#235

Post by judge2020 »

thrwaway1985882 wrote: post #30
internet_points wrote: post #2

So if you send a picture to a Signal user, it's retrieved via cloudflare, and cached in a data center near that user; now you can look up the cache status and find the data center used. I'd say "deanonymization" is stretching it, unless the user is in the middle of nowhere (no other users near the data center). But interesting writeup anyway.

"Near a user" is also a big assumption. I'm ~200 miles to ORD and ~500 to IAD, but my ISP's peering & upstream arrangements mean Cloudflare serves my traffic 700 miles from DFW. But, at the same time: Cloudflare isn't going to serve me a cache from Seattle, Manchester, or Tokyo. Pinning down an unknown Signal user to even a rough geographic location is an important bit of metadata that could combine to unmask an indi…

Note that CF will also route relative to the sites' plan. Enterprise sites are almost always routed to the closest DC, while if that DC is overloaded then lower tier websites, typically just Free sites, will get routed elsewhere (I suppose this is achieved via different anycast ranges where a specific DC is excluded). Although Discord, Signal, etc are almost certainly Enterprise sites.

I have this old site to test this (the list of sites is a bit old): https://cloudflare-test.judge.sh/

Re: 0-click deanonymization attack targeting Signal, Discord, other platforms

#236

Post by aprilnya »

jrochkind1 wrote: post #209
thayne wrote: post #140

What is the benefit of caching images in a cdn for Signal? Assuming local client-side caching, the total number of requests for that resource should be very small, probably one in the vast majority of cases. On an unrelated note, it seems like CloudFront could very easily fix this by not returning the cf-ray header, or at least having an option for the customer to remove it. Although, it might still be possible to ge…

I dont' believe the Signal app/network is choosing to cacheimages in a CDN? But any user can send anyone other user a message that includes a link to a CDN-cached resource. Isn't that the "attack" here? Or am I misunderstanding?

Signal does cache them in a CDN. If the vulnerability was sending any link, you could just set up your own web server and get the person’s IP

Re: 0-click deanonymization attack targeting Signal, Discord, other platforms

#237

Post by lxgr »

udev4096 wrote: post #188
lxgr wrote: post #135

Earlier quoted context omitted.

Yes, I read it. Information about your IP address is leaked, as that's how Cloudflare routes you to a given datacenter. And I strongly disagree that being able to uncover somebody's rough geographic location is not a privacy problem. I wouldn't be surprised if this, for example, lets you deduce if somebody is currently home, at work, or commuting (as all three ISPs might be hitting different Cloudflare datacenters).…

If you aren't comfortable broadcasting it, then maybe take measures so that it doesn't get to that point. Privacy is not by default, ever

To quote Signal themselves:

> Privacy isn’t an optional mode — it’s just the way that Signal works. Every message, every call, every time [1]

While I don't consider this a critical bug requiring an immediate technical remediation from Signal, this should definitely be either fixed or called out in the documentation at some point.

[1] https://support.signal.org/hc/en-us/articles/360007320391-Is...

Re: 0-click deanonymization attack targeting Signal, Discord, other platforms

#238

Post by kelnos »

j3s wrote: post #88
dare944 wrote: post #51

Earlier quoted context omitted.

"bit of a sensationalist" is reasonable feedback; no slack needed. After all, this is how they learn.

people learn when they’re given kind, direct, actionable feedback from people they trust - not when they’re called sensationalists by random critics on the internet. what have you made lately?

I think "this writing is sensationalist" is constructive, actionable feedback.

And I think expecting that all criticism must come from people the target of it knows and trusts is a bit much.

> what have you made lately?

Plenty of stuff. But that's irrelevant. People are free to give feedback regardless of what they've been working on.

Re: 0-click deanonymization attack targeting Signal, Discord, other platforms

#239

Post by HeatrayEnjoyer »

udev4096 wrote: post #188
lxgr wrote: post #135

Earlier quoted context omitted.

Yes, I read it. Information about your IP address is leaked, as that's how Cloudflare routes you to a given datacenter. And I strongly disagree that being able to uncover somebody's rough geographic location is not a privacy problem. I wouldn't be surprised if this, for example, lets you deduce if somebody is currently home, at work, or commuting (as all three ISPs might be hitting different Cloudflare datacenters).…

If you aren't comfortable broadcasting it, then maybe take measures so that it doesn't get to that point. Privacy is not by default, ever

Privacy by default is Signal's entire brand

Re: 0-click deanonymization attack targeting Signal, Discord, other platforms

#240

Post by vel0city »

jrochkind1 wrote: post #207
vel0city wrote: post #184

Earlier quoted context omitted.

I wonder if view-once media is even handled the same way as a regular attachment (using CF) or is sent more like a regular message. I imagine if one really wanted it to be view-once, it wouldn't go to a CDN. Thanks for pointing this out!

I think view-once media there means media hosted on signal servers, not remote servers? But not entirely sure.

I'd love a hard answer to this if anyone knows or has time to look at the source code.

https://github.com/signalapp

Post reply on HN