The developers of the popular privacy-focused messaging application Signal have rushed to patch a serious vulnerability in the Android version that can be exploited by an attacker to eavesdrop on users.
The flaw, tracked as CVE-2019-17191, was discovered by Google Project Zero researcher Natalie Silvanovich. The issue was reported to Signal developers in late September and it was patched very quickly with the release of version 4.47.7 for Android.
The vulnerability can be exploited by using a specially crafted Signal client. The client initiates an audio call to the targeted user, and once it starts ringing, the attacker presses the audio mute button on their end, which forces the called device to answer the call.
Silvanovich noted in her bug report that the attacker cannot force the application to answer a video call.
The issue also impacts the iOS version of Signal. However, the researcher points out that on iOS “the call is not completed due to an error in the UI caused by the unexpected sequence of states.” Silvanovich recommends “improving the logic in both clients, as it is possible the UI problem doesn’t occur in all situations.”
After details of the bug were made public, Signal’s creator, Moxie Marlinspike, noted on Twitter that the exploit does not allow an attacker to silently enable the targeted device’s microphone — the victim would see on the screen that there is an ongoing call, and the call is logged in Signal’s list of conversations.
In a separate bug report, Silvanovich revealed that Signal processes Real-time Transport Protocol (RTP) packets before a video call is answered, which makes it possible for malicious actors to exploit vulnerabilities in WebRTC’s processing of RTP packets without user interaction.
WebRTC is a free and open-source project that provides real-time communication capabilities to mobile applications via simple APIs.
According to the researcher, Signal developers described this issue as a “design trade-off” that they do not plan on addressing in the near future. However, Marlinspike says he is open to recommendations for improving security in Signal’s implementation of WebRTC.
Related: Google Researchers Find Remotely Exploitable Vulnerabilities in iOS
Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- Exploitation of 55 Zero-Day Vulnerabilities Came to Light in 2022: Mandiant
- Organizations Notified of Remotely Exploitable Vulnerabilities in Aveva HMI, SCADA Products
- Waterfall Security, TXOne Networks Launch New OT Security Appliances
- Hitachi Energy Blames Data Breach on Zero-Day as Ransomware Gang Threatens Firm
- New York Man Arrested for Running BreachForums Cybercrime Website
- Exploitation of Recent Fortinet Zero-Day Linked to Chinese Cyberspies
- Mozilla Patches High-Severity Vulnerabilities With Release of Firefox 111
- Microsoft: 17 European Nations Targeted by Russia in 2023 as Espionage Ramping Up
Latest News
- Google Suspends Chinese Shopping App Amid Security Concerns
- Verosint Launches Account Fraud Detection and Prevention Platform
- Ransomware Gang Publishes Data Allegedly Stolen From Maritime Firm Royal Dirkzwager
- Zoom Paid Out $3.9 Million in Bug Bounties in 2022
- Oleria Scores $8M Seed Funding for ID Authentication Technology
- Exploitation of 55 Zero-Day Vulnerabilities Came to Light in 2022: Mandiant
- News Analysis: UK Commits $3 Billion to Support National Quantum Strategy
- Malicious NuGet Packages Used to Target .NET Developers
