Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

0-click deanonymization attack targeting Signal, Discord, other platforms

gist.github.com

Post reply on HN
Print view View original

351–360 of 474 posts

Re: 0-click deanonymization attack targeting Signal, Discord, other platforms

#351

Post by danielparks »

LWIRVoltage wrote: post #150
danielparks wrote: post #97

Earlier quoted context omitted.

I just sent a feature request[1] to Signal with the following text: I understand that Signal does not consider this https://gist.github.com/hackermondev/45a3cdfa52246f1d1201c1e8cdef6117 to be a valid security bug, but it would be helpful to at least be able to mitigate it. Please add an option in settings to disable automatically downloading attachments. That should be enough to change the attack from 0-click (just o…

Hold on, someone else in this thread noted this does exist " You can disable the auto-download. Settings > Data and storage > Media auto-download, you can choose what to auto download for mobile data/wifi/roaming." So, that part is there, but my question is, it's still aissue when they manually download the image, right? Unless something never accepts images from someone they aren't expecting, who 's number or unique…

Oh, nice. I looked under Settings > Privacy and didn’t see anything. For me it was under Settings > Data Usage.

Yes, this still an issue if you manually download an attachment, but that’s a lot better than automatically when you open a conversation.

Re: 0-click deanonymization attack targeting Signal, Discord, other platforms

#352

Post by lmm »

meowface wrote: post #217
gruez wrote: post #138

Earlier quoted context omitted.

>Or you post a meme to a Californian left-wing group and it gets cached in DC. Not hard to imagine situations where getting an unexpected rough location could be a valuable signal. Not really. Any public meme group is inevitably going to be monitored by intelligence agencies, and you should assume as such. Even if it isn't, I can imagine agitators from the other side joining the group with a Russian VPN to poison the…

I would bet money almost no public meme groups are monitored by any intelligence agencies. And the few that are mostly only are just in the sense of being casually co-opted by state-sponsored trolls with almost no attention from actual intelligence agency staff (in the way this thread implies, with investigations and deanonymization and such).

I'm sure they're "monitored by intelligence agencies" in the sense of having a line in a database/report somewhere (that probably no-one reads). If the technique mentioned in TFA can be used automatically (and I see no reason it shouldn't) then it will probably be incorporated in due course (if it hasn't been already) - it doesn't have to be 100% accurate, it's just one more datapoint to add to the mix.

Re: 0-click deanonymization attack targeting Signal, Discord, other platforms

#354

Post by thayne »

angry_octet wrote: post #311
thayne wrote: post #140

What is the benefit of caching images in a cdn for Signal? Assuming local client-side caching, the total number of requests for that resource should be very small, probably one in the vast majority of cases. On an unrelated note, it seems like CloudFront could very easily fix this by not returning the cf-ray header, or at least having an option for the customer to remove it. Although, it might still be possible to ge…

It isn't caching, it's CDNing. It is just an artefact of CDNs that they act as caches for the original content, and for improved distribution response time they cache to the nearest server from the response. ('Nearest' being an approximate heuristic, it is property of the anycast route tables in the BGP routers the request passes through, it is actually a 'best route'.)

That caching is something you can turn off, at least for every CDN that I have worked with.

The Cache-Control http header has a `private` directive specifically to inform CDNs and similar not to cache the response.

Re: 0-click deanonymization attack targeting Signal, Discord, other platforms

#355

Post by tEem21 »

rosseitsa wrote: post #195
aimazon wrote: post #171

Earlier quoted context omitted.

The counter point is that anyone who cares about being anonymous is using methods to disguise their identity that cannot be compromised by this attack, e.g: a VPN. Plus, there are much more effective versions of this attack, like sending a link to an endpoint that you control -- getting someone to click a link isn't hard if you're considered trustworthy enough to send them notifications. And less technical versions,…

I am not sure I understand what you mean by "trustworthy enough to send them notifications". Do you need anything other than one's phone number to send them a signal message?

The recipient would need to have this enabled, though it is by default. You can deactivate allowing others to initiate chats with you from your phone number (Settings > Privacy > Phone number)

Re: 0-click deanonymization attack targeting Signal, Discord, other platforms

#356

Post by alp1n3_eth »

mqus wrote: post #323
alp1n3_eth wrote: post #284

Earlier quoted context omitted.

Signal's default setup is more usability focused while supporting E2E, and less about tinfoil hat threat models about being present on a continent you're a citizen of. The items you mentioned can essentially be configured, for those that want the insane level of privacy / security. Messages can be auto-deleted 30 seconds after being seen, a proxy can be configured to route all your traffic through it, and tons of oth…

> Signal's default setup is more usability focused while supporting E2E If images/attachments were e2ee, this problem probably wouldn't exist, right? or are the images on cloudflare encrypted? Edit: I should clarify. I didn't mean the encryption itself fixes the problem, but rather that: If this were handled like the text messages we send (not via cloudflare CDNs) then this wouldn't exist. I get that attachments are…

From what I know* (heavy on the asterisk there), they are. I'm guessing at their setup at this point, but it sounds like the "large" data is probably being stored (while encrypted) in a different way / separately than the messaging. Since it's supposedly E2E (not gonna pretend I've hand verified it), it's decrypted on the device, but it needs to be grabbed in the first place from said separate place.

So, I'm guessing the images are encrypted where they're stored. And from his post it sounds like it doesn't happen with the messages, so the motivation for using CloudFlare probably is around egress pricing, or they could be using CloudFlare R2 for storage as well.

Re: 0-click deanonymization attack targeting Signal, Discord, other platforms

#357

Post by kiwijamo »

cenamus wrote: post #157
maxrmk wrote: post #146

Cool! Contrary to some of the other posters I think this definitely counts as deanonymization, or at least is close enough. How anonymous would satoshi be today if we had his location to within 250 miles? Repeated applications of this attack (maybe disguised somehow?) could let you track someone’s travel over time, and it is usually only takes 4-5 zip code sized locations to uniquely identify someone.

How many people live in a 250 mile circle around New York?

How many people live in a 250 mile circle around their Cloudflare POP?

Which Cloudflare POP I hit depends on which RSP I use. In the country I live in, our biggest RSP peers with Cloudflare in a neighboring country (as it is much cheaper for Cloudfare to send traffic via that RSP's peering exchange there). So something like 40% of traffic will seem to be from a entirely different country than reality.

My RSP is a small RSP which until fairly recently only had two POPs in the entire country. So regardless of where you lived, customers of my RSP would have traffic exiting onto the internet via only one of two exit points. Rural users would seem to be coming from one of the two largest cities in my country even if they are easily >250miles way from their particular POP. They do peer with Cloudflare but obviously only at the locations where they and Cloudflare are in the same city (and I'm not sure this is the case -- it is possible all national traffic to Cloudflare traffic actually goes via the one POP in our biggest city).

The only reason this attack identifies the city I happen to be in is because I live in the same city as my little's RSP's biggest POP and Cloudflare happens to peer with that RSP at that POP. Where I am is a large city so doesn't narrow things down very much -- but even worse is that whoever is looking for me would actually need to look anywhere in my country.

I don't think I am an unique case as internet routing is rarely the most direct path for various technical, financial, political, etc reasons.

De-anonymization is definitely stretching the reality of what this 'attack' is capable of IMHO.

Re: 0-click deanonymization attack targeting Signal, Discord, other platforms

#358

Post by alp1n3_eth »

why_only_15 wrote: post #302
alp1n3_eth wrote: post #33

Cool writeup with some interesting techniques and approaches! I'll echo the other comments and say "deanonymization" is stretching the definition of the word, along with "grab the user's location", as it isn't anything near precise. 150 miles is approx. a 2-hour drive on the highway from Atlanta, GA to Augusta, GA. In that radius, there's probably 700,000+ people. I do think the auto-retrieve attachment feature of Si…

Random unrelated point: in a 100km radius circle between Atlanta and Augusta there are ~2,000,000 people (calculated using https://www.tomforth.co.uk/circlepopulations/ )

Haha thank you for doing the math! I was lazy and just added the populations and a plus at the end.

Re: 0-click deanonymization attack targeting Signal, Discord, other platforms

#359

Post by crtasm »

raphman wrote: post #259
8338550bff96 wrote: post #160

Earlier quoted context omitted.

I doubt how useful it would be as an attack. As a single point of info it tells you next to nothing. As part of a composition of other indicators it would be the weak link in the chain probably just causing noise for the not un-likly scenario where the person you're targeting is using a VPN. If it was any less specific we'd be talking about a deanonymization attack that outs whether or not a target is still on Earth.

Oh, this attack would be a useful tool for e.g., identifying whistleblowers that travel a lot (e.g., in academia, military). If you know their Signal ID, you could send them images from time to time and then compare their coarse locations with travel information for a number of suspects.

I believe they'd have to accept the chat request before any images would be loaded?

Looking at the app options it seems to be possible to disable media auto-download entirely; there's tickboxes for Images/Audio/Video/Documents via Mobile Data/Wi-Fi/Roaming.

Re: 0-click deanonymization attack targeting Signal, Discord, other platforms

#360

Post by iforgot22 »

kelnos wrote: post #234

Why has Signal even enabled caching for those URLs? The most common case is going to be that the attachment is downloaded once, and that's it. I would even expect that Signal wouldn't allow you to download it more than once, and would immediately delete it after the first successful download. Well, ok, maybe the client fails mid-way through, so allow some grace period for a re-download. But I can't imagine that would…

Group chats and multi-device users maybe
Post reply on HN