Signal: Incoming call can be connected without user interaction • Hacker News Board

Re: Signal: Incoming call can be connected without user interaction

#31

Post by zenexer » Sat, Oct 05, 2019, 2:05 PM UTC

loeg wrote: post #23

wolf550e wrote: post #9

Two separate issues: https://bugs.chromium.org/p/project-zero/issues/detail?id=19... webrtc data being handled before call answered, problematic in theory, Moxie can't get webrtc upstream to fix it ( https://twitter.com/moxie/status/1180226374851710976 ), not fixed yet. https://bugs.chromium.org/p/project-zero/issues/detail?id=19... State machine bug in Signal app, you can send the callee the message the caller gets…

> State machine bug in Signal app Exploitable in the Android Signal app in particular; not the iOS one.

It’s potentially exploitable on iOS, but a UI issue has so far prevented the exploit from being useful. That’s not to say it couldn’t be exploited in a useful manner, and the vulnerability is still present. Continuing to use an unpatched version on iOS would be high-risk.

Re: Signal: Incoming call can be connected without user interaction

#32

Post by wolf550e » Sat, Oct 05, 2019, 2:28 PM UTC

thinkbud wrote: post #28

wolf550e wrote: post #9

Two separate issues: https://bugs.chromium.org/p/project-zero/issues/detail?id=19... webrtc data being handled before call answered, problematic in theory, Moxie can't get webrtc upstream to fix it ( https://twitter.com/moxie/status/1180226374851710976 ), not fixed yet. https://bugs.chromium.org/p/project-zero/issues/detail?id=19... State machine bug in Signal app, you can send the callee the message the caller gets…

Deja Vu. > you can send the callee the message the caller gets when the callee answers This is the exact same type of bug that was in libssh: https://www.nccgroup.trust/uk/our-research/technical-advisor... "possible to bypass authentication by presenting to the server an SSH2_MSG_USERAUTH_SUCCESS message in place of the SSH2_MSG_USERAUTH_REQUEST message which the server would expect to initiate authentication" Also,…

Yes, it's a classic bug, also reminds me of https://mitls.org/pages/attacks/SMACK#skip

Re: Signal: Incoming call can be connected without user interaction

#33

Post by matheusmoreira » Sat, Oct 05, 2019, 2:34 PM UTC

gretch wrote: post #29

feanaro wrote: post #25

Earlier quoted context omitted.

The fact it's open source enabled someone outside the project to find it in practice. While also possible with closed source software, if you think the bar is possibly too high with an open source project, it is an order of magnitude higher with closed source. Also, please don't say "Google". A bunch of hackers (on Google's payroll) found it, not Google. We can't tell what would've happened in a counterfactual univer…

I’m shocked at how cynical your perspective is that you don’t grant credit here. Like if I said “the police didn’t save me from the hostage situation. Some hero saved me who happened to be working for the police. In an alternate universe we don’t where this guy isn’t employed by the police, we don’t know if he wouldn’t have saved me anyway” Can’t you just say, thanks police, you saved me.

> Can’t you just say, thanks police, you saved me.

No. The police doesn't actually have to save people. When that happens, it's because of the heroism of individual officers.

https://en.wikipedia.org/wiki/Warren_v._District_of_Columbia

Re: Signal: Incoming call can be connected without user interaction

#34

Post by pushedx » Sat, Oct 05, 2019, 3:06 PM UTC

thinkbud wrote: post #28

wolf550e wrote: post #9

Two separate issues: https://bugs.chromium.org/p/project-zero/issues/detail?id=19... webrtc data being handled before call answered, problematic in theory, Moxie can't get webrtc upstream to fix it ( https://twitter.com/moxie/status/1180226374851710976 ), not fixed yet. https://bugs.chromium.org/p/project-zero/issues/detail?id=19... State machine bug in Signal app, you can send the callee the message the caller gets…

Deja Vu. > you can send the callee the message the caller gets when the callee answers This is the exact same type of bug that was in libssh: https://www.nccgroup.trust/uk/our-research/technical-advisor... "possible to bypass authentication by presenting to the server an SSH2_MSG_USERAUTH_SUCCESS message in place of the SSH2_MSG_USERAUTH_REQUEST message which the server would expect to initiate authentication" Also,…

And what’s the common theme here? Naive switch statement logic instead of a real state machine with fully mapped transitions.

Re: Signal: Incoming call can be connected without user interaction

#35

Post by askmike » Sun, Oct 06, 2019, 5:42 AM UTC

feanaro wrote: post #30

gretch wrote: post #29

Earlier quoted context omitted.

I’m shocked at how cynical your perspective is that you don’t grant credit here. Like if I said “the police didn’t save me from the hostage situation. Some hero saved me who happened to be working for the police. In an alternate universe we don’t where this guy isn’t employed by the police, we don’t know if he wouldn’t have saved me anyway” Can’t you just say, thanks police, you saved me.

I just prefer congratulating the actual people that did this instead of the relatively arbitrary money supplier. You could say I'm equally shocked that credit is propagated as "Google" instead of the names of the researchers.

The reason I said Google because I think that if the NSA pulled some strings at Google, this exploit would not have been published. As such this was all in the hands of Google.