Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

0-click deanonymization attack targeting Signal, Discord, other platforms

gist.github.com

Post reply on HN
Print view View original

301–310 of 474 posts

Re: 0-click deanonymization attack targeting Signal, Discord, other platforms

#301

Post by cekanoni »

crawfordcomeaux wrote: post #149
lolinder wrote: post #23

Earlier quoted context omitted.

> Given Cloudflare's less-than-straight approach to sales, it is astonishing the words "secure" and "Signal" ever appear in the same sentence. This is an overly binary take. Security is all about threat models, and for most of us the threat model that Signal is solving is "mainstream for-profit apps snoop on the contents of my messages and use them to build an advertising profile". Most of us using it are not using S…

Hello, I'm an organizer for a system to coordinate multiple mutual aid networks, many of which are only organizing by Signal & Protonmail exclusively because they think they're secure and private. People who are doing work to help people in ways the state tries to prevent (like giving people food) rely on this tech. These are the same groups who were able to mobilize so quickly to respond to the LA fires, but the Red…

people who think protonmail is secure it's to the same level as mail.yahoo.com :)

Re: 0-click deanonymization attack targeting Signal, Discord, other platforms

#302

Post by why_only_15 »

alp1n3_eth wrote: post #33

Cool writeup with some interesting techniques and approaches! I'll echo the other comments and say "deanonymization" is stretching the definition of the word, along with "grab the user's location", as it isn't anything near precise. 150 miles is approx. a 2-hour drive on the highway from Atlanta, GA to Augusta, GA. In that radius, there's probably 700,000+ people. I do think the auto-retrieve attachment feature of Si…

Random unrelated point: in a 100km radius circle between Atlanta and Augusta there are ~2,000,000 people (calculated using https://www.tomforth.co.uk/circlepopulations/ )

Re: 0-click deanonymization attack targeting Signal, Discord, other platforms

#303

Post by bufferoverflow »

internet_points wrote: post #2

So if you send a picture to a Signal user, it's retrieved via cloudflare, and cached in a data center near that user; now you can look up the cache status and find the data center used. I'd say "deanonymization" is stretching it, unless the user is in the middle of nowhere (no other users near the data center). But interesting writeup anyway.

CloudFlare has the actual IP address that viewed the image. Which means some powerful (or rich enough) actors can get it.

This is very very bad.

Re: 0-click deanonymization attack targeting Signal, Discord, other platforms

#304

Post by lolinder »

alp1n3_eth wrote: post #275
soerxpso wrote: post #272

Earlier quoted context omitted.

"Deanonymization" doesn't have to refer to a full exact address. There are people who wish to conceal which country or region they live in, which this cripples. There was a real example of that amount of information being relevant in the Silk Road investigation. Ulbricht accidentally revealed his timezone early on, which was useful to US authorities since it narrowed him down to being in the US, whereas without that…

Not really. Anyone who wants to conceal what continent they're on will also be using a VPN 24/7, or will have the proxy setup in Signal (AKA running 24/7), which defeats this.

Yep: If your threat model includes an attack like this and you're not always on a VPN already, you're likely already compromised.

This is a neat demo, but it should not fundamentally alter the way that anyone is using Signal. Either it doesn't matter to you or you already have mitigations in place.

Re: 0-click deanonymization attack targeting Signal, Discord, other platforms

#306

Post by Funes- »

flagos10 wrote: post #288

Just by the fact he's expressing distances in miles, I can say he's from USA. That's my 0-click deanonymisation. Nice attack otherwise.

>Just by the fact he's expressing distances in miles, I can say he's from USA.

And you could be falling into his trap of getting you to believe so by expressing distance in miles, as well.

Re: 0-click deanonymization attack targeting Signal, Discord, other platforms

#307

Post by cthalupa »

kuschku wrote: post #190
gruez wrote: post #121

Earlier quoted context omitted.

Not really. It's only true if the bits are uncorrelated, and you can acquire additional bits of information. I don't see how you can go from "this guy on the internet lives near Albuquerque, New Mexico" to "this guy is Walter Hartwell White, and lives at 308 Negra Arroyo Lane, Albuquerque, New Mexico, 87104" without massive opsec failures.

Every little bit helps. You can plot the timestamps of every message, read receipt and emoji reaction, which gives you the timezone and hints at work schedule, commute duration and vacations. Often people will post photos or have profile pictures. Say you have a photo taken at a random mcdonalds. That'd be 36'000 locations. Imagine cloudflare location and timezone help you narrow it down to new mexico. That's 80 loca…

You can almost certainly narrow down the McDonalds with a wide variety of things - this example is fairly contrived.

If you can see outside of the McDonalds for street view to be usable, you're almost certainly able to determine what country it is in, and potentially the exact location, depending on what is visible outside.

If it's a picture that shows the menu, well, street view isn't likely to be super useful, but you'd have a trivial time figuring out what country it is in at that point - menus vary from country to country, even when they are still in English.

New Mexico has relatively few McDonald's restaurants because New Mexico has a fairly low population - only 2.1m for the whole state. With that in mind, it seems unlikely that that Cloudflare has a close enough POP for you to be able to specifically decide it's NM.

If I can see enough for Street View to be able to confirm location, it seems like I can just search via the data there and get far more narrowed down results. If I can see a Burger King and a Best Buy outside from the picture, I can just use one of the many mapping services with APIs to get a list of all McDonalds locations within a tenth of a mile of a Burger King and Best Buy and look through a smaller list. If I'm confident of the time zone, like you suggest we should be able to be, then that's an even smaller list.

I'm not saying this attack is useless by any means, but I don't see a world where the sharing of the pictures to begin with isn't the most significant opsec failure and doesn't open you up to being de-anonymized in a myriad of other ways.

Re: 0-click deanonymization attack targeting Signal, Discord, other platforms

#308

Post by cthalupa »

bufferoverflow wrote: post #303
internet_points wrote: post #2

So if you send a picture to a Signal user, it's retrieved via cloudflare, and cached in a data center near that user; now you can look up the cache status and find the data center used. I'd say "deanonymization" is stretching it, unless the user is in the middle of nowhere (no other users near the data center). But interesting writeup anyway.

CloudFlare has the actual IP address that viewed the image. Which means some powerful (or rich enough) actors can get it. This is very very bad.

This was... always, the case though? For any CDN service? How do you serve traffic to people without knowing where to send it?

Re: 0-click deanonymization attack targeting Signal, Discord, other platforms

#309

Post by 0xCMP »

scottydelta wrote: post #294

How is it different than sending someone an image hosted on your server which is a tracking pixel and just get their IP+location? This will be more accurate than the cloudflare approach.

Well, unlike with tracking pixels, you are not in the direct request path and cannot block it. You also have no way monitor/log if it is happening (like you can in theory with a packet capture).

It's obvious in hindsight, but I bet no one would have mentioned this possibility as why you should disable notification previews or that simply receiving a notification would possibly reveal this information.

Re: 0-click deanonymization attack targeting Signal, Discord, other platforms

#310

Post by bufferoverflow »

cthalupa wrote: post #308
bufferoverflow wrote: post #303

Earlier quoted context omitted.

CloudFlare has the actual IP address that viewed the image. Which means some powerful (or rich enough) actors can get it. This is very very bad.

This was... always, the case though? For any CDN service? How do you serve traffic to people without knowing where to send it?

Onion protocol.
Post reply on HN