What's old is new. Does anyone remember the forum signatures that would display the viewers IP address and location on a little wooden signpost held up by a troll-looking creature?
0-click deanonymization attack targeting Signal, Discord, other platforms
31–40 of 474 posts
Re: 0-click deanonymization attack targeting Signal, Discord, other platforms
#32> it's possible for an attacker to run a cache geolocation attack to find out which local datacenter they're near--similar to how law enforcement track mobile devices through cell phone towers.
very much disagree on this, they track mobile devices through your connection strength to multiple cellular towers while this attack proves which singular datacenter the victim is nearest.
Don’t get me wrong the write up is really interesting but it does feel like the author is a bit of a sensationalist.
Re: 0-click deanonymization attack targeting Signal, Discord, other platforms
#33Cool writeup with some interesting techniques and approaches!
I'll echo the other comments and say "deanonymization" is stretching the definition of the word, along with "grab the user's location", as it isn't anything near precise. 150 miles is approx. a 2-hour drive on the highway from Atlanta, GA to Augusta, GA. In that radius, there's probably 700,000+ people.
I do think the auto-retrieve attachment feature of Signal is slightly concerning, as for a private messenger I'd expect there to be an option to turn it off (like turning off JS in Tor). I don't know if I'm not looking deep enough, but there doesn't seem to be a feature for that.
Signal appears to take a useful-by-default approach that balances privacy and ease-of-use in order to encourage adoption by the masses, I'd assume most people that are really concerned are hardening Signal, similar to what is in this guide: https://www.privacyguides.org/articles/2022/07/07/signal-con... . They've always recommended a VPN / proxy + a modification of settings for more high-security scenarios.
Caching isn't going anywhere, and neither is CloudFlare. The DoSing days of old in P2P multiplayer lobbies with exposed IPs seemed to carry more of a threat than this, CloudFlare's response seems to be the best out of the 3. Caching sensitive information is never recommended and the onus is on the application doing the communicating to tell their CDN / middle-service to not cache specific items.
Re: 0-click deanonymization attack targeting Signal, Discord, other platforms
#34This is certainly an "attack" but not one you'd normally associate with zero click. There is no code execution, but some tricks to see which Cloudflare datacenter cached the image -- giving a very rough area the user is in. Impressive and insightful nonetheless.
depending on the circumstance, the rough area might already be useful to adversaries of the person trying to hide. I wouldn't expect things like criminals etc. to suffer from this, 300 miles is a big radius for example... but if you want to know if 'the guy is still in country' or something like that (for instance law enforcement) it's useful for them. such parties could then collaborate with local resources to do fu…
You would know if they are over a cellular network or checking on mobile.
If someone sends you a youtube link and you hit play, YT knows who you are, both from a network perspective and potentially the logged in user.
If you are using signal in a high risk environment, you should be using it from a system that contains no extra information about you. This is the same posture one should take when using Tor.
Basic opsec.
I don't think these kinds of things are in signals threat model. It is meant? as a message platform for people with nothing to hide?
Re: 0-click deanonymization attack targeting Signal, Discord, other platforms
#35Earlier quoted context omitted.
I wonder if we'll see assets being padded to some common byte sizes to combat this.
Nothing stops Cloudflare from inspecting the file contents, or using a hash to distinguish between identically-sized files. The only reason we assume they don't do this is because it's a waste of resources for no good reason. But what if somebody gave them a good reason?
Aren’t the files end-to-end encrypted? How would they inspect the files?
Re: 0-click deanonymization attack targeting Signal, Discord, other platforms
#36Unless I'm missing something, this seems like an incredibly long winded way to check the users IP location? For example, connecting to a VPN and checking https://cloudflare.com/cdn-cgi/trace gives me `colo:CPH` (Copenhagen) which is far from my nearest CF datacenter (geographically), closer to the IP location from my VPN provider (Oslo) but still not particularly close? If I don't use a VPN, I don't even get the capi…
Do you not buy that a user's IP location needs to be protected?
There is a reason applications go to so much effort to proxy requests to resources such as images. It's not free to do this.
Re: 0-click deanonymization attack targeting Signal, Discord, other platforms
#37What's old is new. Does anyone remember the forum signatures that would display the viewers IP address and location on a little wooden signpost held up by a troll-looking creature? https://cdn.geekzone.co.nz/images/forums/danasoftcache.jpg
Just like the days of DoSing an IP from a COD Lobby
Re: 0-click deanonymization attack targeting Signal, Discord, other platforms
#38> it's possible for an attacker to run a cache geolocation attack to find out which local datacenter they're near--similar to how law enforcement track mobile devices through cell phone towers. very much disagree on this, they track mobile devices through your connection strength to multiple cellular towers while this attack proves which singular datacenter the victim is nearest. Don’t get me wrong the write up is re…
> Don’t get me wrong the write up is really interesting but it does feel like the author is a bit of a sensationalist.
They claim to be 15 years old. Cut them some slack.
Re: 0-click deanonymization attack targeting Signal, Discord, other platforms
#39For being 15 year old, cool work!
But calling this de-anonymization is a stretch, if it can possibly pinpoint you within 250 miles (that's assuming geoip is correct too, which it rarely is).
In their GeoGuesser demonstration video, the higlighted area is densely populated and you still would need to match millions of people vs the online user.
It does provide some hints as to the location of the targeted user, and that is cool!
Re: 0-click deanonymization attack targeting Signal, Discord, other platforms
#40Earlier quoted context omitted.
Nothing stops Cloudflare from inspecting the file contents, or using a hash to distinguish between identically-sized files. The only reason we assume they don't do this is because it's a waste of resources for no good reason. But what if somebody gave them a good reason?
Aren’t the files end-to-end encrypted? How would they inspect the files?
Last time I used Cloudflare I think their settings default to only "Origin SSL/TLS" (or whatever they call it), which wouldn't encrypt anything between Cloudflare and the origin, it would only encrypt data between Cloudflare and the end-user/browser.