CVE-2018-14023

Details 

Signal version 1.14.3 was vulnerable to the recovery of expired messages.
When I reported the vulnerability to the Signal Security Team, its experts fixed it in a very short time, but the fix was partial; in fact version 1.14.4, even though fixed one vulnerability, was still vulnerable to a different attack. I reported the new issue to the security team and version 1.15.0-beta.10 finally addressed the problem.

Everything started from a message that was not cleared from the preview of Signal-Desktop

so I said this message must be stored somewhere…, I tried to dump the memory and BOOM 🙂 the message was still there. Messages were stored in the log [I think to double check that they are actually deleted] but they did not clear them with a garbage collector or whatever so I was able to recover them].

The version 1.14.4 fixed this issue but I wanted to try if it was possible to recover messages again from the logs and they were still there. The issue was related to IndexedDB not deleting messages predictably.

Below a video PoC of the vulnerability:

Solution

Update Signal to version 1.15.0-beta.10

Final thoughts:

I am very happy to have contributed to the security of Signal, an application that I use every day to talk with my friends, professors…

My contribution was also possible because this is an open-source project and other than just reporting the security hole I had the opportunity to analyze the source code and highlight the flaw.

This is a small example of how effective is the open-source model and I hope everyone can understand the benefits of the community contribution in data protection field so that everybody can provide contributions.

Sorry I can not hear you, there’s interference

n0sign4l 🙂

About the author Leonardo Porpora

I am 17 years old and since I started dealing with informatics and cybersecurity I have been inspired by E. Snowden character, bravery, and value, even when he faced hard consequences for his actions. To me, he is a really special person and I consider him like a brother.

Defending human rights – and privacy in particularly – is a must in a democratic society and for this reason, in my opinion, everybody should use Signal messaging application for their communications.