8 ms·

Signal says there is no evidence rumored zero-day bug is real

88 points by Wasserpuncher 3y ago

kspacewalk2 3y ago
The author of the linked tweet has retracted it.[0] [0] https://twitter.com/gaughen/status/1713792849269997687 https://twitter.com/gaughen/status/1713792849269997687)
- pengaru 3y ago
  https://nitter.net/gaughen/status/1713792849269997687 https://nitter.net/gaughen/status/1713792849269997687
- laweijfmvo 3y ago
  > I spend my life fighting disinformation online, so I always regret when I accidentally spread it. My apologies. So.... what did this person do to verify the information before sharing it? Since they 'spend their life' fighting disinformation, surely they didn't just retweet it blindly? Right?
  - cilky 3y ago
    It's not the first piece of disinformation he's spread, and it won't be the last. He claims that he fights disinformation to make his own spreading of it seem like a sincere mistake when he's caught out.
  - mike_hock 3y ago
    I mean the proposed mitigation is just common sense and should have been enabled (i.e. the feature disabled) anyway. Generating a "link preview" involves invoking some sort of browser engine to some degree, so "has a zero-day vulnerability" is virtually guaranteed to be true, whether or not you have a report of a concrete exploit.
    - kccqzy 3y ago
      No you don't need a browser engine. You just need a basic HTML parser that understands OG meta tags.
fragmede 3y ago
"We have no evidence" is one thing, but a report on the fuzz testing the link preview feature has undergone would be more reassuring.
- hansvm 3y ago
  To be fair, they did (as the article states) check with the supposed source and confirm the source was unaware of the bug, they proposed a mitigation if you want to be cautious till the bug is confirmed to not exist, and they're investigating further.
evertedsphere 3y ago
blogspam for https://twitter.com/signalapp/status/1713789257599353084 https://twitter.com/signalapp/status/1713789257599353084
dylan604 3y ago
If it were anyone other than Signal: Today's headline: We Have No Evidence $Product Is Vuln Tomorrow's headline: Hacker Releases Data Dump From $Product
- deleted 3y ago
  [deleted]
- xmodem 3y ago
  Not necessarily - see the recent bogus curl CVE's for instance. There's a lot of incentives to invent or embellish vulnerabilities for street cred or other reasons. Many years ago, a 'researcher' made claims to the media that our product had a zero-day that looked like a deliberate backdoor. They refused to tell us anything about the bug.
  - dylan604 3y ago
    What kind of cred does the street give for making stuff up and posting about something that doesn't work? Seems like that would be one of those things where nature takes care of itself by weeding out these players.
    - xmodem 3y ago
      An embellishment can often be put down to a difference of opinion, and vendors have a reputation for downplaying vulnerabilities. In our case, the media reported the researcher's claims uncritically alongside our denials. We decided the best strategy was to say as little as possible, as saying or doing more wouldn't improve the quality of the reporting and would only risk drawing more attention to the false claims. I think we had a good track record of handling vulnerabilities well, and we definitely had some nasty ones. But this was not one of them.
SkyMarshal 3y ago
The mitigation was to go into settings and disable image preview. I imagine many privacy/security-conscious HN's already have that setting disabled.
- tptacek 3y ago
  But, as a bunch of people pointed out when that meme started spreading, link previews in Signal are generated by the sender, for privacy reasons, so this never really made all that much sense.
  - hunter2_ 3y ago
    It would make sense if the alleged exploit targeted the sender, no?
ehhthing 3y ago
Sounds like a version of the WebP bug that abuses link previews to display the image maybe?
- sergioisidoro 3y ago
  When I heard about this, I also associated the two. The report talks about link preview generation, so it sounded like someone could put a webp on the social metadata of a page for link previews, and then send it as a malicious payload. But that would mean any app with link preview (eg. slack, whatsapp, discord) would also be affected...
- Klonoar 3y ago
  Nothing in the linked article even remotely suggests that.
- tptacek 3y ago
  Signal patched WebP weeks ago.
- tedunangst 3y ago
  How can a bug that doesn't exist sound like anything?
red_trumpet 3y ago
> This statement comes after numerous sources told BleepingComputer and reported on Twitter that a new zero-day vulnerability allowed for a full takeover of devices. If that were true, it wouldn't only be a Signal vulnerability, but also one of Android/iOS.
IIlIlIllI 3y ago
> We also checked with people across US Government, since the copy-paste report claimed USG as a source. Those we spoke to have no info suggesting this is a valid claim Well yes, of course they said that, they're not going to disclose their million-dollar zero-days to you are they.
jrflowers 3y ago
I was really impressed with Signal’s choice to add link previews to my secure chats. It struck me as a feature with nothing but upside for a security-and-privacy focused messaging app. I am glad to be reassured that fetching data from arbitrary servers inside of a secure chat continues to be worth the benefit of being able to see a little thumbnail of a page.

88 points by Wasserpuncher 3y ago

The author of the linked tweet has retracted it.[0] [0] https://twitter.com/gaughen/status/1713792849269997687 https://twitter.com/gaughen/status/1713792849269997687)

pengaru 3y ago
https://nitter.net/gaughen/status/1713792849269997687 https://nitter.net/gaughen/status/1713792849269997687
laweijfmvo 3y ago
> I spend my life fighting disinformation online, so I always regret when I accidentally spread it. My apologies. So.... what did this person do to verify the information before sharing it? Since they 'spend their life' fighting disinformation, surely they didn't just retweet it blindly? Right?
- cilky 3y ago
  It's not the first piece of disinformation he's spread, and it won't be the last. He claims that he fights disinformation to make his own spreading of it seem like a sincere mistake when he's caught out.
- mike_hock 3y ago
  I mean the proposed mitigation is just common sense and should have been enabled (i.e. the feature disabled) anyway. Generating a "link preview" involves invoking some sort of browser engine to some degree, so "has a zero-day vulnerability" is virtually guaranteed to be true, whether or not you have a report of a concrete exploit.
  - kccqzy 3y ago
    No you don't need a browser engine. You just need a basic HTML parser that understands OG meta tags.

fragmede 3y ago

"We have no evidence" is one thing, but a report on the fuzz testing the link preview feature has undergone would be more reassuring.

hansvm 3y ago
To be fair, they did (as the article states) check with the supposed source and confirm the source was unaware of the bug, they proposed a mitigation if you want to be cautious till the bug is confirmed to not exist, and they're investigating further.

evertedsphere 3y ago

blogspam for https://twitter.com/signalapp/status/1713789257599353084 https://twitter.com/signalapp/status/1713789257599353084

dylan604 3y ago

If it were anyone other than Signal: Today's headline: We Have No Evidence $Product Is Vuln Tomorrow's headline: Hacker Releases Data Dump From $Product

deleted 3y ago
[deleted]
xmodem 3y ago
Not necessarily - see the recent bogus curl CVE's for instance. There's a lot of incentives to invent or embellish vulnerabilities for street cred or other reasons. Many years ago, a 'researcher' made claims to the media that our product had a zero-day that looked like a deliberate backdoor. They refused to tell us anything about the bug.
- dylan604 3y ago
  What kind of cred does the street give for making stuff up and posting about something that doesn't work? Seems like that would be one of those things where nature takes care of itself by weeding out these players.
  - xmodem 3y ago
    An embellishment can often be put down to a difference of opinion, and vendors have a reputation for downplaying vulnerabilities. In our case, the media reported the researcher's claims uncritically alongside our denials. We decided the best strategy was to say as little as possible, as saying or doing more wouldn't improve the quality of the reporting and would only risk drawing more attention to the false claims. I think we had a good track record of handling vulnerabilities well, and we definitely had some nasty ones. But this was not one of them.

SkyMarshal 3y ago

The mitigation was to go into settings and disable image preview. I imagine many privacy/security-conscious HN's already have that setting disabled.

tptacek 3y ago
But, as a bunch of people pointed out when that meme started spreading, link previews in Signal are generated by the sender, for privacy reasons, so this never really made all that much sense.
- hunter2_ 3y ago
  It would make sense if the alleged exploit targeted the sender, no?

ehhthing 3y ago

Sounds like a version of the WebP bug that abuses link previews to display the image maybe?

sergioisidoro 3y ago
When I heard about this, I also associated the two. The report talks about link preview generation, so it sounded like someone could put a webp on the social metadata of a page for link previews, and then send it as a malicious payload. But that would mean any app with link preview (eg. slack, whatsapp, discord) would also be affected...
Klonoar 3y ago
Nothing in the linked article even remotely suggests that.
tptacek 3y ago
Signal patched WebP weeks ago.
tedunangst 3y ago
How can a bug that doesn't exist sound like anything?

red_trumpet 3y ago

> This statement comes after numerous sources told BleepingComputer and reported on Twitter that a new zero-day vulnerability allowed for a full takeover of devices. If that were true, it wouldn't only be a Signal vulnerability, but also one of Android/iOS.

IIlIlIllI 3y ago

> We also checked with people across US Government, since the copy-paste report claimed USG as a source. Those we spoke to have no info suggesting this is a valid claim Well yes, of course they said that, they're not going to disclose their million-dollar zero-days to you are they.

jrflowers 3y ago

I was really impressed with Signal’s choice to add link previews to my secure chats. It struck me as a feature with nothing but upside for a security-and-privacy focused messaging app. I am glad to be reassured that fetching data from arbitrary servers inside of a secure chat continues to be worth the benefit of being able to see a little thumbnail of a page.