The developers of the popular privacy-focused messaging application Signal have rushed to patch a serious vulnerability in the Android version that can be exploited by an attacker to eavesdrop on users.
The flaw, tracked as CVE-2019-17191, was discovered by Google Project Zero researcher Natalie Silvanovich. The issue was reported to Signal developers in late September and it was patched very quickly with the release of version 4.47.7 for Android.
The vulnerability can be exploited by using a specially crafted Signal client. The client initiates an audio call to the targeted user, and once it starts ringing, the attacker presses the audio mute button on their end, which forces the called device to answer the call.
Silvanovich noted in her bug report that the attacker cannot force the application to answer a video call.
The issue also impacts the iOS version of Signal. However, the researcher points out that on iOS “the call is not completed due to an error in the UI caused by the unexpected sequence of states.” Silvanovich recommends “improving the logic in both clients, as it is possible the UI problem doesn’t occur in all situations.”
After details of the bug were made public, Signal’s creator, Moxie Marlinspike, noted on Twitter that the exploit does not allow an attacker to silently enable the targeted device’s microphone — the victim would see on the screen that there is an ongoing call, and the call is logged in Signal’s list of conversations.
In a separate bug report, Silvanovich revealed that Signal processes Real-time Transport Protocol (RTP) packets before a video call is answered, which makes it possible for malicious actors to exploit vulnerabilities in WebRTC’s processing of RTP packets without user interaction.
WebRTC is a free and open-source project that provides real-time communication capabilities to mobile applications via simple APIs.
According to the researcher, Signal developers described this issue as a “design trade-off” that they do not plan on addressing in the near future. However, Marlinspike says he is open to recommendations for improving security in Signal’s implementation of WebRTC.
Related: Google Researchers Find Remotely Exploitable Vulnerabilities in iOS