Signal: Incoming call can be connected without user interaction

But why, when a security issue is fixed, whitehats tend to always disclose immediately? Since it is fixed it is not relevant any more, and disclosing now only increases the likelihood of a hacker abusing the bug. Instead wouldn't it be better if the targeted entity just disclosed that "a critical security vulnerability was found" and that "users should upgrade immediately"?

I don't see the point of disclosing the specifics of a fixed security vulnerability soon after the fix? I understand that recognition is an important factor, but isn't it more logical to delay the recognition step for e. g. 6 months?

Re: Signal: Incoming call can be connected without user interaction

#5

Post by tpush » Fri, Oct 04, 2019, 11:27 PM UTC

Koffiepoeder wrote: post #4

hprotagonist wrote: post #2

fixed for a week. Update and you should be good.

What I don't understand is: I'm a big fan of maintaining a forced 90 day disclosure period to pressure companies that do not address relevant security bugs. But why, when a security issue is fixed, whitehats tend to always disclose immediately? Since it is fixed it is not relevant any more, and disclosing now only increases the likelihood of a hacker abusing the bug. Instead wouldn't it be better if the targeted enti…

A hacker doesn't need the disclosure if a patch is already available.

Re: Signal: Incoming call can be connected without user interaction

#6

Post by ilikepi » Fri, Oct 04, 2019, 11:30 PM UTC

Koffiepoeder wrote: post #4

hprotagonist wrote: post #2

fixed for a week. Update and you should be good.

What I don't understand is: I'm a big fan of maintaining a forced 90 day disclosure period to pressure companies that do not address relevant security bugs. But why, when a security issue is fixed, whitehats tend to always disclose immediately? Since it is fixed it is not relevant any more, and disclosing now only increases the likelihood of a hacker abusing the bug. Instead wouldn't it be better if the targeted enti…

Well, even if the bug report wasn't disclosed, there's a decent chance it was reverse engineered out of the patch that was released a week ago by anyone with enough determination. It seems like the act of disclosing it soon after the patch is available allows information to propagate through the security community, which in theory helps accelerate the spread of the update.

Re: Signal: Incoming call can be connected without user interaction

#7

Post by kbenson » Fri, Oct 04, 2019, 11:32 PM UTC

Koffiepoeder wrote: post #4

hprotagonist wrote: post #2

fixed for a week. Update and you should be good.

What I don't understand is: I'm a big fan of maintaining a forced 90 day disclosure period to pressure companies that do not address relevant security bugs. But why, when a security issue is fixed, whitehats tend to always disclose immediately? Since it is fixed it is not relevant any more, and disclosing now only increases the likelihood of a hacker abusing the bug. Instead wouldn't it be better if the targeted enti…

Because blackhats look through updates to determine what has been fixed by reversing the change, and try to capitalize on the time between an update being available and it being widely deployed. The more you raise awareness of people that might be susceptible to attack in that time frame to get them to update sooner than automated systems would allow, the less victims there are to exploit.

I imagine there's probably a short time after update release, almost definitely in the single or double digit hours range, where you might be helping the blackhat that would reverse it do it quicker, but it's probably hard to do more harm than benefit by releasing the details earlier than later.

Re: Signal: Incoming call can be connected without user interaction

#8

Post by [deleted] » Fri, Oct 04, 2019, 11:55 PM UTC

[deleted]

Re: Signal: Incoming call can be connected without user interaction

#9

Post by wolf550e » Sat, Oct 05, 2019, 12:04 AM UTC

Two separate issues:

https://bugs.chromium.org/p/project-zero/issues/detail?id=19...

webrtc data being handled before call answered, problematic in theory, Moxie can't get webrtc upstream to fix it (https://twitter.com/moxie/status/1180226374851710976), not fixed yet.

https://bugs.chromium.org/p/project-zero/issues/detail?id=19...

State machine bug in Signal app, you can send the callee the message the caller gets when the callee answers and the callee will think the call has started and enable the mic. No user interaction, but with log and indication (https://twitter.com/moxie/status/1180261210341511168), fixed same day.

Re: Signal: Incoming call can be connected without user interaction

#10

Post by jka » Sat, Oct 05, 2019, 12:14 AM UTC

It looks like this was shortly preceded by https://bugs.chromium.org/p/project-zero/issues/detail?id=19... which was an exploration of the fact that making a call induces RTP data processing on a recipient device during a call, prior to the recipient answering.

That 'seems' innocuous (and both Signal and WebRTC had reasonable arguments around expecting that behaviour) but this follow-up exploit looks more serious, and the researcher is correct to note how an expanded attack surface can lead to problems like this :/