Security Experts:

Connect with us

Hi, what are you looking for?


Mobile & Wireless

Signal Rushes to Patch Serious Eavesdropping Vulnerability

The developers of the popular privacy-focused messaging application Signal have rushed to patch a serious vulnerability in the Android version that can be exploited by an attacker to eavesdrop on users.

The developers of the popular privacy-focused messaging application Signal have rushed to patch a serious vulnerability in the Android version that can be exploited by an attacker to eavesdrop on users.

The flaw, tracked as CVE-2019-17191, was discovered by Google Project Zero researcher Natalie Silvanovich. The issue was reported to Signal developers in late September and it was patched very quickly with the release of version 4.47.7 for Android.

The vulnerability can be exploited by using a specially crafted Signal client. The client initiates an audio call to the targeted user, and once it starts ringing, the attacker presses the audio mute button on their end, which forces the called device to answer the call.

Silvanovich noted in her bug report that the attacker cannot force the application to answer a video call.

The issue also impacts the iOS version of Signal. However, the researcher points out that on iOS “the call is not completed due to an error in the UI caused by the unexpected sequence of states.” Silvanovich recommends “improving the logic in both clients, as it is possible the UI problem doesn’t occur in all situations.”

After details of the bug were made public, Signal’s creator, Moxie Marlinspike, noted on Twitter that the exploit does not allow an attacker to silently enable the targeted device’s microphone — the victim would see on the screen that there is an ongoing call, and the call is logged in Signal’s list of conversations.

In a separate bug report, Silvanovich revealed that Signal processes Real-time Transport Protocol (RTP) packets before a video call is answered, which makes it possible for malicious actors to exploit vulnerabilities in WebRTC’s processing of RTP packets without user interaction.

WebRTC is a free and open-source project that provides real-time communication capabilities to mobile applications via simple APIs.

According to the researcher, Signal developers described this issue as a “design trade-off” that they do not plan on addressing in the near future. However, Marlinspike says he is open to recommendations for improving security in Signal’s implementation of WebRTC.

Related: Google Researchers Find Remotely Exploitable Vulnerabilities in iOS

Related: Apple Working on Patch to Prevent FaceTime Spying

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join this webinar to learn best practices that organizations can use to improve both their resilience to new threats and their response times to incidents.


Join this live webinar as we explore the potential security threats that can arise when third parties are granted access to a sensitive data or systems.


Expert Insights

Related Content


Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Application Security

Drupal released updates that resolve four vulnerabilities in Drupal core and three plugins.

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...


Apple has released updates for macOS, iOS and Safari and they all include a WebKit patch for a zero-day vulnerability tracked as CVE-2023-23529.

Cloud Security

VMware vRealize Log Insight vulnerability allows an unauthenticated attacker to take full control of a target system.

Application Security

A CSRF vulnerability in the source control management (SCM) service Kudu could be exploited to achieve remote code execution in multiple Azure services.

IoT Security

Lexmark warns of a remote code execution (RCE) vulnerability impacting over 120 printer models, for which PoC code has been published.


GoAnywhere MFT users warned about a zero-day remote code injection exploit that can be targeted directly from the internet