11 ms·

So if you send a picture to a Signal user, it's retrieved via cloudflare, and cached in a data center near that user; now you can look up the cache status and f

So if you send a picture to a Signal user, it's retrieved via cloudflare, and cached in a data center near that user; now you can look up the cache status and find the data center used. I'd say "deanonymization" is stretching it, unless the user is in the middle of nowhere (no other users near the data center). But interesting writeup anyway.

wkat4242 2y ago
> (no other users near the data center). Yeah and in that case there won't be a data center because who puts one in places without clients nearby? :)
naavis 2y ago
Indeed, "incredibly precise estimate of the user's location" feels like an exaggeration. But still, very interesting!
bigbones 2y ago
It gets more interesting when you think about the impact on groups. Sending an image to a group is enough for all devices associated with that group to be identifiable from CloudFlare's side, who additionally see a giant chunk of unencrypted traffic from the same client addresses going to other web sites. Given Cloudflare's less-than-straight approach to sales, it is astonishing the words "secure" and "Signal" ever appear in the same sentence. CloudFlare get to see a fuckton of metadata from private and group chats, enough to trace who originally sends a piece of media (identifiable from its file size), who reads it, when it is is read, who forwards it and to whom. It really doesn't matter that they can't see an image or video, knowing its size upfront or later (for example in response to a law enforcement request) is enough
- paulryanrogers 2y ago
  I wonder if we'll see assets being padded to some common byte sizes to combat this.
  - kijin 2y ago
    Nothing stops Cloudflare from inspecting the file contents, or using a hash to distinguish between identically-sized files. The only reason we assume they don't do this is because it's a waste of resources for no good reason. But what if somebody gave them a good reason?
    - echoangle 2y ago
      Aren’t the files end-to-end encrypted? How would they inspect the files?
      - diggan 2y ago
        Last time I used Cloudflare I think their settings default to only "Origin SSL/TLS" (or whatever they call it), which wouldn't encrypt anything between Cloudflare and the origin, it would only encrypt data between Cloudflare and the end-user/browser.
        lolinder 2y ago
        But the Signal client encrypts images before sending them to the Signal server. If it padded out the images at that point, the images would all be indistinguishable from each other unless Cloudflare were actually able to break the encryption (which would completely undermine the entire security model).
        diggan 2y ago
        Ah yes, I'm sorry, I mistook the context. If Signal encrypts the images E2E, you're right that it wouldn't matter what Cloudflare does, especially if padded.
        shim__ 2y ago
        So the image is uploaded for each recipient with an individual key?
        2y ago
- lolinder 2y ago
  > Given Cloudflare's less-than-straight approach to sales, it is astonishing the words "secure" and "Signal" ever appear in the same sentence. This is an overly binary take. Security is all about threat models, and for most of us the threat model that Signal is solving is "mainstream for-profit apps snoop on the contents of my messages and use them to build an advertising profile". Most of us using it are not using Signal to skirt law enforcement, so our threat model does not include court orders and warrants. Signal can and should append some noise to the images when encrypted (or better yet, pad them to a set file size as suggested by paulryanrogers in a sibling comment) to mitigate the risks of this attack for those who do have threat models that require it, but for the vast majority of us Signal is just as fit for purpose as we thought it was.
  - crawfordcomeaux 2y ago
    Hello, I'm an organizer for a system to coordinate multiple mutual aid networks, many of which are only organizing by Signal & Protonmail exclusively because they think they're secure and private. People who are doing work to help people in ways the state tries to prevent (like giving people food) rely on this tech. These are the same groups who were able to mobilize so quickly to respond to the LA fires, but the Red Cross & police worked to shut down. This impacts the people who are there for you when the state refuses to show up. This impacts the future version of you who needs it. Most people aren't disabled, yet. Doesn't mean they don't need us building infrastructure for if/when they become disabled.
    - Evidlo 2y ago
      What groups did the police and Red Cross shut down? Any links?
      - deleted 2y ago
        [deleted]
      - basilgohar 2y ago
        In any geopolitical crisis, you tend to have victims on both sides be prevented from getting relief, except when the one side is imperial. The powerful entities tend to prohibit relief to the oppressed side, even making it illegal.
- doodlebugging 2y ago
  >It gets more interesting when you think about the impact on groups. Sending an image to a group is enough for all devices associated with that group to be identifiable from CloudFlare's side, Doesn't this open up the possibility to identify groups that have been infiltrated by spies or similar posers? If you use this method to kinda-sorta locate or identify all the users in your group and one or more of those users ends up being located in a region where you should have no active group members then you may have identified a mole in your network. Just thinking out loud here since there's no one else home.
  - gruez 2y ago
    >If you use this method to kinda-sorta locate or identify all the users in your group and one or more of those users ends up being located in a region where you should have no active group members then you may have identified a mole in your network. ...unless they happen to be using a VPN for geo-unblocking reasons or whatever.
    - lolinder 2y ago
      If you're in a group like this where people are seriously concerned about their location being discovered by governments or by their own contacts, anyone in that group who is not already on a VPN all the time is either ignorant or nuts.
      - throwway120385 2y ago
        Communication of any sort over any channel risks sharing location information. Silence is secrecy.
- KennyBlanken 2y ago
  > , it is astonishing the words "secure" and "Signal" ever appear in the same sentence. You misspelled "I do not understand what end to end encryption means"
xnorswap 2y ago
It could be useful for correlation. Say for example that you're an investigating agent in regular contact with someone. A single data-point wouldn't mean anything. However, a sequence of daily image retrievals might tell you that they spend 90% of their time in WA and 10% of their time elsewhere. That information alone still might not mean anything, but if you also have a specific suspect in mind, it may help confirm it. Or if you have access to the suspected person directly, if you're able to also befriend their "clean" profile, you might be able to pull the same trick and correlate the two location profiles. De-anonymisation isn't about single pieces of information, but all information helps feed into a profile to narrow suspects or confirm suspicions. ( By "agent" I just mean a person, not an AI agent nor Law enforcement, who could presumably just get the information more directly from cloudflare. )
- immibis 2y ago
  There's probably at least a few instances where you send someone you think is American a picture but it gets cached in Moscow, or vice versa. Or you post a meme to a Californian left-wing group and it gets cached in DC. Not hard to imagine situations where getting an unexpected rough location could be a valuable signal.
  - gruez 2y ago
    >Or you post a meme to a Californian left-wing group and it gets cached in DC. Not hard to imagine situations where getting an unexpected rough location could be a valuable signal. Not really. Any public meme group is inevitably going to be monitored by intelligence agencies, and you should assume as such. Even if it isn't, I can imagine agitators from the other side joining the group with a Russian VPN to poison the well. If there's a private group of people that you supposedly trust, any competent mole is going to be using device/network level VPN to cover their tracks. Otherwise they're 1 click away (eg. if someone shared a link) from an opsec fail.
    - meowface 2y ago
      I would bet money almost no public meme groups are monitored by any intelligence agencies. And the few that are mostly only are just in the sense of being casually co-opted by state-sponsored trolls with almost no attention from actual intelligence agency staff (in the way this thread implies, with investigations and deanonymization and such).
thrwaway1985882 2y ago
"Near a user" is also a big assumption. I'm ~200 miles to ORD and ~500 to IAD, but my ISP's peering & upstream arrangements mean Cloudflare serves my traffic 700 miles from DFW. But, at the same time: Cloudflare isn't going to serve me a cache from Seattle, Manchester, or Tokyo. Pinning down an unknown Signal user to even a rough geographic location is an important bit of metadata that could combine to unmask an individual. Neat attack!
- btown 2y ago
  It's also quite insidious as you don't need to control anything on any server to get this information; as long as you can get your target to load a unique URL never before loaded by anyone else, you can simply later poll it with an unauthenticated HTTP GET from different locations, and find which one reports a Cloudflare HIT (or, even if they hid that information, finding the one that returns with lower latency). If you're allowing user uploaded content, and you use Cloudflare as a CDN, you could mitigate and provide your users with plausible deniability by prefetching each uploaded URL from random data centers. But, of course, that's going to make your Cloudflare bill that much more expensive. Cloudflare could allow security-sensitive clients to hide the cache-hit header and add randomized latency upon a cache hit, but the latter protection would also be expensive in how many connections must be kept alive longer than they otherwise would. Don't do anything on a personal device or account if you want your datacenter to be hidden!
  - ipaddr 2y ago
    Going forward uploaded content should never go through cloudflaire and it never really needed to. Add unique urls. Maybe just avoid it altogether.
    - gabeio 2y ago
      > Going forward uploaded content should never go through cloudflaire and it never really needed to. The problem in this case isn't cloudflare. The problem is that these images load without the user's interaction and the person sending it gets to choose if it's cloudflare or not. So your statement within this context doesn't really work.
whoopdedo 2y ago
Send picture to multiple accounts, perhaps on different services, the links that are cached at the same data center can be more confidently believed to be related.
cyanydeez 2y ago
timing and location can usually prune things down to enough data about a person.
quotemstr 2y ago
Even time zone leaks are privacy issues, and the leak we're discussing is more fine grained than time zone.
dinosaurdynasty 2y ago
It only takes 33 bits to identify someone. This reveals a couple of bits.
- gruez 2y ago
  Not really. It's only true if the bits are uncorrelated, and you can acquire additional bits of information. I don't see how you can go from "this guy on the internet lives near Albuquerque, New Mexico" to "this guy is Walter Hartwell White, and lives at 308 Negra Arroyo Lane, Albuquerque, New Mexico, 87104" without massive opsec failures.
  - chatmasta 2y ago
    Repeat the attack daily for a few weeks and you might get a pattern of movement. Of course if the target hasn’t left their general area then this won’t help. But if you’re a nation state watching a target move between multiple international locations, you could match this up with passport travel data to significantly reduce the anonymity set.
    - gruez 2y ago
      Seems contrived. What type of a person cares about deanonymization attacks and nation-states trying to find him, but doesn't have an always-on VPN? Even without this attack, not using a VPN means you're 1 wrong click/tap away (if you accidentally clicked on a link) from leaking your IP.
      - chatmasta 2y ago
        Right, agreed that VPN is the primary mitigation against this from a user perspective. But opsec is hard, especially when the attack can be triggered by a notification when the victim might not be expecting it and might not have VPN enabled (e.g. maybe they only enable VPN when using Discord). (But notifications are already a bad idea for opsec anyway.)
        2y ago
65 2y ago
I'd say it'd be useful for very specific use cases. Such as finding out what country Jia Tan, the XZ Utils backdoor attacker, is in.
cassepipe 2y ago
I wonder if it'd be a good idea for Signal to implement a "simple" mode that would deactivate most features in order to reduce the attack surface for people who really think they are being targeted. Would that be a good idea ?
lxgr 2y ago
It's not stretching it. The expectation is that Signal does not reveal any observable aspect of your IP address or location when receiving messages on it. Whether this specific level/type of deanonymization is a problem for your particular use case is an entirely different question. Personally, I wouldn't even care if mutual contacts were to see my IP address outright (and they do for calls), but I'm not every user.
- pyeri 2y ago
  Exactly. Especially when considering that Signal was often advertised as that *one* privacy friendly open-source messaging solution in a world dominated by data-collecting demons like WhatsApp, etc. I don't think even WhatsApp let's such status details leak; notwithstanding whatever they might be doing with the user data on the backend.
  - sojournerc 2y ago
    I can send a link in Whatsapp to a domain I control and track if clicked. How is that different?
    - lxgr 2y ago
      The difference is that your target needs to actually click it. For this, they don't.
- genewitch 2y ago
  I don't care if users see "my" ipv4 because cgnat. I think i don't care if they can see my ipv6 because each machine gets a /64 to itself, that's the logic, right? But my PBX and my matrix server both use coturn. Our 10 user "private" PBX we have to VPN into a fortigate in a DC to use, but to my understanding, there's literally no way to eavesdrop on those calls without already compromising the server it's running on, and if that's the case, no extra VPN steps or whatever will help. anyhow even with a real, publicly routable IP, stock windows 11, stock macos (used to be true), and most linuxes won't get compromised by stuff like backorifice or whatever else l0pht put out as "remote administration tools". that is, there usually isn't any listening ports on a public IP these days. Shield's Up!
hmottestad 2y ago
If I know someone on Signal I can now check if they’ve left the country. Or send this to a bunch of signal users whom you suspect one of them being a particular person, and if you know that the person you are looking for is going to travel you can send it once before and once after. Then see which of these users were in the home city and subsequently in the destination city.
- sojournerc 2y ago
  A VPN obfuscates this. Assuming a target is even remotely aware, you might think they are in Australia, while they're actually in Nova Scotia
  - iforgot22 2y ago
    Say I send a message to someone who has a phone with push notifications enabled, showing message previews. Will the phone still be connected to the VPN when it wakes up to display the message? Because my iPhone doesn't seem to stay connected to my VPN when it sleeps, at least not reliably. There really should be a "never use the internet without VPN" mode on devices.
    - sojournerc 2y ago
      Valid point. Afaict, vpns I've used route all network activity regardless of phone state, but that's likely dependant on the service.
      - iforgot22 2y ago
        I don't see how that can work for the push packet itself, cause I thought that's specially handled by some low-power hardware on the phone while the main parts are shut off. Unless that hardware is also managing the VPN connection, which I doubt. So if there's no always-on hardware maintaining that VPN connection, probably the phone is going to wake up without it. And even if it auto-reconnects, it'll probably load stuff before it's connected to the VPN.
paulpauper 2y ago
This is not unique to signal. URL strings can contain identifying information regardless of where they are shared or posted. For example, if you send a link that ends with string of characters, these may correspond to a geographic location or browser settings. Blogger urls used to be geolocated, such as .ca for Canadian viewers. it is always safe to strip out unnecessary chacters if you're paranoid.
dlandis 2y ago
> attacker can use the cache geolocation method to pinpoint the recipient’s location Agree, good writeup, but also a stretch to say they are "pinpointing" anyone's location.
ncr100 2y ago
Mmmm "qualified deanonymization" perhaps?
harrall 2y ago
When I was ~15 and this was ~2004, some friends and I ran a forum with a lot of users and did some bad things where we would track down repeat banned users and screw with them. (In our defense, they were screwing with us.) We used everything, from browser fingerprinting (and EFF only made the world aware of it 6 years later), looking them up in databases, tracing every digital evidence they left, etc. Every little thing counted. What I learned is that people leave a lot of traces and you can collect these traces to dox them. The way you write is even sometimes fairly identifiable.
mmooss 2y ago
Combined with other information, it may identify someone reliably, just like you can with zip code, age and gender. For example, if you know this person is part of a group with members in several locations, or if you can corroborate someone's movements, etc. For example, imagine someone suspected of sharing sensitive information with a journalist. They might have a short list of suspects, and use this technique to confirm which one it is. They might identify which journalist it is - maybe only a limited number cover this beat.
- cutemonster 2y ago
  Or you want to find a specific journalist, and you find out that they just arrived to a certain city, and there are only three hotels in that city...
  - mmooss 2y ago
    That doesn't tell you whether that journalist is investigating you. Identifying them as the recipient of a Signal message from a suspect is valuable information.
    - cutemonster 2y ago
      I mean to assassinate
      - mmooss 2y ago
        Why are we talking about assassination?
oceanplexian 2y ago
The real attack is that a law enforcement agency can trivially subpoena CloudFlare with the attachment URL they will hand over the IP address of the recipient of the image along with whatever other requests they made through the CDN which can pretty precisely and rapidly de-anonymize you.
snapcaster 2y ago
It's leaking so many bits idk what else you would call it, deanonymization isn't a one shot thing and it's a spectrum not a binary outcome
soerxpso 2y ago
"Deanonymization" doesn't have to refer to a full exact address. There are people who wish to conceal which country or region they live in, which this cripples. There was a real example of that amount of information being relevant in the Silk Road investigation. Ulbricht accidentally revealed his timezone early on, which was useful to US authorities since it narrowed him down to being in the US, whereas without that information he could have been from anywhere in the world.
- alp1n3_eth 2y ago
  Not really. Anyone who wants to conceal what continent they're on will also be using a VPN 24/7, or will have the proxy setup in Signal (AKA running 24/7), which defeats this.
  - lolinder 2y ago
    Yep: If your threat model includes an attack like this and you're not always on a VPN already, you're likely already compromised. This is a neat demo, but it should not fundamentally alter the way that anyone is using Signal. Either it doesn't matter to you or you already have mitigations in place.
    - bigiain 2y ago
      > If your threat model includes an attack like this The problem is, nobody's threat model includes state level attackers, until one day it does. Back when Ulbricht was publicly asking questions using an easily uncovered identity, he wasn't thinking that in a few years he'd have the full force of every relevant TLA in the US (and Five Eyes/14 Eyes) trying to track him down.
      - lolinder 2y ago
        But he also chose to go on and found a darknet narcotics service. Most people don't do something like that. Yes, it's vogue right now to speculate that what you're doing right now could suddenly become illegal in a new administration, but if that happens tomorrow, most of us would be one of hundreds of thousands who are all in the same boat. For that reason, most of us won't get targeted retroactively for behaviors that were legal at the time, and we have the option to reevaluate our security posture when the political landscape changes. But yeah, if you're actively speculating about starting an illegal service today, you should definitely have a better security posture than Ulbricht did.
cekanoni 2y ago
Headline feels like a click bait :)
bufferoverflow 2y ago
CloudFlare has the actual IP address that viewed the image. Which means some powerful (or rich enough) actors can get it. This is very very bad.
- cthalupa 2y ago
  This was... always, the case though? For any CDN service? How do you serve traffic to people without knowing where to send it?
  - bufferoverflow 2y ago
    Onion protocol.
  - endofreach 2y ago
    Agree. Though a valid concern might be that a victim uses signal because of E2EE, thinking no 3rd party involved in delivery, not knowing/thinking about a CDN used.
iforgot22 2y ago
Looks like it's possible to hit 2 datacenters due to load-balancing, which would narrow it down a bit more. Suppose you do this repeatedly as the target is moving around, hitting even more datacenters.
antidamage 2y ago
Imagine sending a friend request to bin Laden's videographer and getting a reply from Pakistan while your entire military is looking for him in Afghanistan? There's definitely cases where this is going to be immediately used. Shit, just using it to scrape Cloudflare for additional metadata on everyone from other user table leaks is probably valuable data. Even triangulation over time as they move around is going to get a more precise result. Maybe you find a vulnerability that takes that cloudflare node offline and run it again, repeat until you've got a fairly small radius they could be in.
KennyBlanken 2y ago
> cached in a data center near that user Not necessarily. Cloudflare is very upfront that they do not cache everything, and the time things are cached can vary greatly. The kid keeps talking about "deanonymization" and he has no idea what the term actually means.
nyclounge 2y ago
For that reason that's why federated setup such as matrix are better. It is much harder to deanonymiza a set of users on different servers in group chat.
TacticalCoder 2y ago
[dead]
jcul 2y ago
WhatsApp has an option to disable link previews. Surprised signal doesn't have this option. I only message people I know on Signal anyway. Edit: it seems signal does have the option
- vdqtp3 2y ago
  I had this same thought before reading the article - this isn't about link previews, it's about attachment caching
  - mazambazz 2y ago
    But previewing can involve automatically loading resources. This "attack" is very similar to CSRF in that your exploit involves making the victim load a specific resource. That's why in secure mail clients, nothing but plaintext should be rendered, and an optional "Load all resources" button is shown for when you trust the sender, and want to load any media elements that require HTTP onto your client. Signal could mitigate this with something similar, where it didn't load the image file AT ALL, and instead showed a message: <User> wants you to load an image from https://example.com/foo.png https://example.com/foo.png. Load image? > Yes > No
    - vdqtp3 2y ago
      The difference being is that it's not a resource controlled by the attacker, it's an attachment hosted by Signal. But yes, removing previews for everything would mitigate the issue.
jeffhuys 2y ago
Did you see the GIF? It's able to triangulate.
tjoff 2y ago
Why does it need to be cached though? The only case where it might be downloaded more than once is if the user has multiple clients. Not that common and still very little traffic.
rkagerer 2y ago
[dupe]
- rkagerer 2y ago
  [dead]
rkagerer 2y ago
Caching attachments at a single nice, big, juicy honeypot like CloudFlare is one of the reasons Signal's privacy guarantees don't feel totally solid to me. I get that it's pragmatic, but feel there must be a better way. Does the caching occur even if both users are online when the attachment is sent?
Gasp0de 2y ago
Why would cloudflare ever operate a data center that only one user at a time is ever near?
BodyCulture 2y ago
You underestimate the value of this piece of information taken at different times. It can be enough to know in which country a person was yesterday or is today.

wkat4242 2y ago

> (no other users near the data center). Yeah and in that case there won't be a data center because who puts one in places without clients nearby? :)

naavis 2y ago

Indeed, "incredibly precise estimate of the user's location" feels like an exaggeration. But still, very interesting!

bigbones 2y ago

It gets more interesting when you think about the impact on groups. Sending an image to a group is enough for all devices associated with that group to be identifiable from CloudFlare's side, who additionally see a giant chunk of unencrypted traffic from the same client addresses going to other web sites. Given Cloudflare's less-than-straight approach to sales, it is astonishing the words "secure" and "Signal" ever appear in the same sentence. CloudFlare get to see a fuckton of metadata from private and group chats, enough to trace who originally sends a piece of media (identifiable from its file size), who reads it, when it is is read, who forwards it and to whom. It really doesn't matter that they can't see an image or video, knowing its size upfront or later (for example in response to a law enforcement request) is enough

paulryanrogers 2y ago
I wonder if we'll see assets being padded to some common byte sizes to combat this.
- kijin 2y ago
  Nothing stops Cloudflare from inspecting the file contents, or using a hash to distinguish between identically-sized files. The only reason we assume they don't do this is because it's a waste of resources for no good reason. But what if somebody gave them a good reason?
  - echoangle 2y ago
    Aren’t the files end-to-end encrypted? How would they inspect the files?
    - diggan 2y ago
      Last time I used Cloudflare I think their settings default to only "Origin SSL/TLS" (or whatever they call it), which wouldn't encrypt anything between Cloudflare and the origin, it would only encrypt data between Cloudflare and the end-user/browser.
      - lolinder 2y ago
        But the Signal client encrypts images before sending them to the Signal server. If it padded out the images at that point, the images would all be indistinguishable from each other unless Cloudflare were actually able to break the encryption (which would completely undermine the entire security model).
        diggan 2y ago
        Ah yes, I'm sorry, I mistook the context. If Signal encrypts the images E2E, you're right that it wouldn't matter what Cloudflare does, especially if padded.
        shim__ 2y ago
        So the image is uploaded for each recipient with an individual key?
      - 2y ago
lolinder 2y ago
> Given Cloudflare's less-than-straight approach to sales, it is astonishing the words "secure" and "Signal" ever appear in the same sentence. This is an overly binary take. Security is all about threat models, and for most of us the threat model that Signal is solving is "mainstream for-profit apps snoop on the contents of my messages and use them to build an advertising profile". Most of us using it are not using Signal to skirt law enforcement, so our threat model does not include court orders and warrants. Signal can and should append some noise to the images when encrypted (or better yet, pad them to a set file size as suggested by paulryanrogers in a sibling comment) to mitigate the risks of this attack for those who do have threat models that require it, but for the vast majority of us Signal is just as fit for purpose as we thought it was.
- crawfordcomeaux 2y ago
  Hello, I'm an organizer for a system to coordinate multiple mutual aid networks, many of which are only organizing by Signal & Protonmail exclusively because they think they're secure and private. People who are doing work to help people in ways the state tries to prevent (like giving people food) rely on this tech. These are the same groups who were able to mobilize so quickly to respond to the LA fires, but the Red Cross & police worked to shut down. This impacts the people who are there for you when the state refuses to show up. This impacts the future version of you who needs it. Most people aren't disabled, yet. Doesn't mean they don't need us building infrastructure for if/when they become disabled.
  - Evidlo 2y ago
    What groups did the police and Red Cross shut down? Any links?
    - deleted 2y ago
      [deleted]
    - basilgohar 2y ago
      In any geopolitical crisis, you tend to have victims on both sides be prevented from getting relief, except when the one side is imperial. The powerful entities tend to prohibit relief to the oppressed side, even making it illegal.
doodlebugging 2y ago
>It gets more interesting when you think about the impact on groups. Sending an image to a group is enough for all devices associated with that group to be identifiable from CloudFlare's side, Doesn't this open up the possibility to identify groups that have been infiltrated by spies or similar posers? If you use this method to kinda-sorta locate or identify all the users in your group and one or more of those users ends up being located in a region where you should have no active group members then you may have identified a mole in your network. Just thinking out loud here since there's no one else home.
- gruez 2y ago
  >If you use this method to kinda-sorta locate or identify all the users in your group and one or more of those users ends up being located in a region where you should have no active group members then you may have identified a mole in your network. ...unless they happen to be using a VPN for geo-unblocking reasons or whatever.
  - lolinder 2y ago
    If you're in a group like this where people are seriously concerned about their location being discovered by governments or by their own contacts, anyone in that group who is not already on a VPN all the time is either ignorant or nuts.
    - throwway120385 2y ago
      Communication of any sort over any channel risks sharing location information. Silence is secrecy.
KennyBlanken 2y ago
> , it is astonishing the words "secure" and "Signal" ever appear in the same sentence. You misspelled "I do not understand what end to end encryption means"

xnorswap 2y ago

It could be useful for correlation. Say for example that you're an investigating agent in regular contact with someone. A single data-point wouldn't mean anything. However, a sequence of daily image retrievals might tell you that they spend 90% of their time in WA and 10% of their time elsewhere. That information alone still might not mean anything, but if you also have a specific suspect in mind, it may help confirm it. Or if you have access to the suspected person directly, if you're able to also befriend their "clean" profile, you might be able to pull the same trick and correlate the two location profiles. De-anonymisation isn't about single pieces of information, but all information helps feed into a profile to narrow suspects or confirm suspicions. ( By "agent" I just mean a person, not an AI agent nor Law enforcement, who could presumably just get the information more directly from cloudflare. )

immibis 2y ago
There's probably at least a few instances where you send someone you think is American a picture but it gets cached in Moscow, or vice versa. Or you post a meme to a Californian left-wing group and it gets cached in DC. Not hard to imagine situations where getting an unexpected rough location could be a valuable signal.
- gruez 2y ago
  >Or you post a meme to a Californian left-wing group and it gets cached in DC. Not hard to imagine situations where getting an unexpected rough location could be a valuable signal. Not really. Any public meme group is inevitably going to be monitored by intelligence agencies, and you should assume as such. Even if it isn't, I can imagine agitators from the other side joining the group with a Russian VPN to poison the well. If there's a private group of people that you supposedly trust, any competent mole is going to be using device/network level VPN to cover their tracks. Otherwise they're 1 click away (eg. if someone shared a link) from an opsec fail.
  - meowface 2y ago
    I would bet money almost no public meme groups are monitored by any intelligence agencies. And the few that are mostly only are just in the sense of being casually co-opted by state-sponsored trolls with almost no attention from actual intelligence agency staff (in the way this thread implies, with investigations and deanonymization and such).

thrwaway1985882 2y ago

"Near a user" is also a big assumption. I'm ~200 miles to ORD and ~500 to IAD, but my ISP's peering & upstream arrangements mean Cloudflare serves my traffic 700 miles from DFW. But, at the same time: Cloudflare isn't going to serve me a cache from Seattle, Manchester, or Tokyo. Pinning down an unknown Signal user to even a rough geographic location is an important bit of metadata that could combine to unmask an individual. Neat attack!

btown 2y ago
It's also quite insidious as you don't need to control anything on any server to get this information; as long as you can get your target to load a unique URL never before loaded by anyone else, you can simply later poll it with an unauthenticated HTTP GET from different locations, and find which one reports a Cloudflare HIT (or, even if they hid that information, finding the one that returns with lower latency). If you're allowing user uploaded content, and you use Cloudflare as a CDN, you could mitigate and provide your users with plausible deniability by prefetching each uploaded URL from random data centers. But, of course, that's going to make your Cloudflare bill that much more expensive. Cloudflare could allow security-sensitive clients to hide the cache-hit header and add randomized latency upon a cache hit, but the latter protection would also be expensive in how many connections must be kept alive longer than they otherwise would. Don't do anything on a personal device or account if you want your datacenter to be hidden!
- ipaddr 2y ago
  Going forward uploaded content should never go through cloudflaire and it never really needed to. Add unique urls. Maybe just avoid it altogether.
  - gabeio 2y ago
    > Going forward uploaded content should never go through cloudflaire and it never really needed to. The problem in this case isn't cloudflare. The problem is that these images load without the user's interaction and the person sending it gets to choose if it's cloudflare or not. So your statement within this context doesn't really work.

whoopdedo 2y ago

Send picture to multiple accounts, perhaps on different services, the links that are cached at the same data center can be more confidently believed to be related.

cyanydeez 2y ago

timing and location can usually prune things down to enough data about a person.

quotemstr 2y ago

Even time zone leaks are privacy issues, and the leak we're discussing is more fine grained than time zone.

dinosaurdynasty 2y ago

It only takes 33 bits to identify someone. This reveals a couple of bits.

gruez 2y ago
Not really. It's only true if the bits are uncorrelated, and you can acquire additional bits of information. I don't see how you can go from "this guy on the internet lives near Albuquerque, New Mexico" to "this guy is Walter Hartwell White, and lives at 308 Negra Arroyo Lane, Albuquerque, New Mexico, 87104" without massive opsec failures.
- chatmasta 2y ago
  Repeat the attack daily for a few weeks and you might get a pattern of movement. Of course if the target hasn’t left their general area then this won’t help. But if you’re a nation state watching a target move between multiple international locations, you could match this up with passport travel data to significantly reduce the anonymity set.
  - gruez 2y ago
    Seems contrived. What type of a person cares about deanonymization attacks and nation-states trying to find him, but doesn't have an always-on VPN? Even without this attack, not using a VPN means you're 1 wrong click/tap away (if you accidentally clicked on a link) from leaking your IP.
    - chatmasta 2y ago
      Right, agreed that VPN is the primary mitigation against this from a user perspective. But opsec is hard, especially when the attack can be triggered by a notification when the victim might not be expecting it and might not have VPN enabled (e.g. maybe they only enable VPN when using Discord). (But notifications are already a bad idea for opsec anyway.)
      - 2y ago

65 2y ago

I'd say it'd be useful for very specific use cases. Such as finding out what country Jia Tan, the XZ Utils backdoor attacker, is in.

cassepipe 2y ago

I wonder if it'd be a good idea for Signal to implement a "simple" mode that would deactivate most features in order to reduce the attack surface for people who really think they are being targeted. Would that be a good idea ?

lxgr 2y ago

It's not stretching it. The expectation is that Signal does not reveal any observable aspect of your IP address or location when receiving messages on it. Whether this specific level/type of deanonymization is a problem for your particular use case is an entirely different question. Personally, I wouldn't even care if mutual contacts were to see my IP address outright (and they do for calls), but I'm not every user.

pyeri 2y ago
Exactly. Especially when considering that Signal was often advertised as that *one* privacy friendly open-source messaging solution in a world dominated by data-collecting demons like WhatsApp, etc. I don't think even WhatsApp let's such status details leak; notwithstanding whatever they might be doing with the user data on the backend.
- sojournerc 2y ago
  I can send a link in Whatsapp to a domain I control and track if clicked. How is that different?
  - lxgr 2y ago
    The difference is that your target needs to actually click it. For this, they don't.
genewitch 2y ago
I don't care if users see "my" ipv4 because cgnat. I think i don't care if they can see my ipv6 because each machine gets a /64 to itself, that's the logic, right? But my PBX and my matrix server both use coturn. Our 10 user "private" PBX we have to VPN into a fortigate in a DC to use, but to my understanding, there's literally no way to eavesdrop on those calls without already compromising the server it's running on, and if that's the case, no extra VPN steps or whatever will help. anyhow even with a real, publicly routable IP, stock windows 11, stock macos (used to be true), and most linuxes won't get compromised by stuff like backorifice or whatever else l0pht put out as "remote administration tools". that is, there usually isn't any listening ports on a public IP these days. Shield's Up!

hmottestad 2y ago

If I know someone on Signal I can now check if they’ve left the country. Or send this to a bunch of signal users whom you suspect one of them being a particular person, and if you know that the person you are looking for is going to travel you can send it once before and once after. Then see which of these users were in the home city and subsequently in the destination city.

sojournerc 2y ago
A VPN obfuscates this. Assuming a target is even remotely aware, you might think they are in Australia, while they're actually in Nova Scotia
- iforgot22 2y ago
  Say I send a message to someone who has a phone with push notifications enabled, showing message previews. Will the phone still be connected to the VPN when it wakes up to display the message? Because my iPhone doesn't seem to stay connected to my VPN when it sleeps, at least not reliably. There really should be a "never use the internet without VPN" mode on devices.
  - sojournerc 2y ago
    Valid point. Afaict, vpns I've used route all network activity regardless of phone state, but that's likely dependant on the service.
    - iforgot22 2y ago
      I don't see how that can work for the push packet itself, cause I thought that's specially handled by some low-power hardware on the phone while the main parts are shut off. Unless that hardware is also managing the VPN connection, which I doubt. So if there's no always-on hardware maintaining that VPN connection, probably the phone is going to wake up without it. And even if it auto-reconnects, it'll probably load stuff before it's connected to the VPN.

paulpauper 2y ago

This is not unique to signal. URL strings can contain identifying information regardless of where they are shared or posted. For example, if you send a link that ends with string of characters, these may correspond to a geographic location or browser settings. Blogger urls used to be geolocated, such as .ca for Canadian viewers. it is always safe to strip out unnecessary chacters if you're paranoid.

dlandis 2y ago

> attacker can use the cache geolocation method to pinpoint the recipient’s location Agree, good writeup, but also a stretch to say they are "pinpointing" anyone's location.

ncr100 2y ago

Mmmm "qualified deanonymization" perhaps?

harrall 2y ago

When I was ~15 and this was ~2004, some friends and I ran a forum with a lot of users and did some bad things where we would track down repeat banned users and screw with them. (In our defense, they were screwing with us.) We used everything, from browser fingerprinting (and EFF only made the world aware of it 6 years later), looking them up in databases, tracing every digital evidence they left, etc. Every little thing counted. What I learned is that people leave a lot of traces and you can collect these traces to dox them. The way you write is even sometimes fairly identifiable.

mmooss 2y ago

Combined with other information, it may identify someone reliably, just like you can with zip code, age and gender. For example, if you know this person is part of a group with members in several locations, or if you can corroborate someone's movements, etc. For example, imagine someone suspected of sharing sensitive information with a journalist. They might have a short list of suspects, and use this technique to confirm which one it is. They might identify which journalist it is - maybe only a limited number cover this beat.

cutemonster 2y ago
Or you want to find a specific journalist, and you find out that they just arrived to a certain city, and there are only three hotels in that city...
- mmooss 2y ago
  That doesn't tell you whether that journalist is investigating you. Identifying them as the recipient of a Signal message from a suspect is valuable information.
  - cutemonster 2y ago
    I mean to assassinate
    - mmooss 2y ago
      Why are we talking about assassination?

oceanplexian 2y ago

The real attack is that a law enforcement agency can trivially subpoena CloudFlare with the attachment URL they will hand over the IP address of the recipient of the image along with whatever other requests they made through the CDN which can pretty precisely and rapidly de-anonymize you.

snapcaster 2y ago

It's leaking so many bits idk what else you would call it, deanonymization isn't a one shot thing and it's a spectrum not a binary outcome

soerxpso 2y ago

"Deanonymization" doesn't have to refer to a full exact address. There are people who wish to conceal which country or region they live in, which this cripples. There was a real example of that amount of information being relevant in the Silk Road investigation. Ulbricht accidentally revealed his timezone early on, which was useful to US authorities since it narrowed him down to being in the US, whereas without that information he could have been from anywhere in the world.

alp1n3_eth 2y ago
Not really. Anyone who wants to conceal what continent they're on will also be using a VPN 24/7, or will have the proxy setup in Signal (AKA running 24/7), which defeats this.
- lolinder 2y ago
  Yep: If your threat model includes an attack like this and you're not always on a VPN already, you're likely already compromised. This is a neat demo, but it should not fundamentally alter the way that anyone is using Signal. Either it doesn't matter to you or you already have mitigations in place.
  - bigiain 2y ago
    > If your threat model includes an attack like this The problem is, nobody's threat model includes state level attackers, until one day it does. Back when Ulbricht was publicly asking questions using an easily uncovered identity, he wasn't thinking that in a few years he'd have the full force of every relevant TLA in the US (and Five Eyes/14 Eyes) trying to track him down.
    - lolinder 2y ago
      But he also chose to go on and found a darknet narcotics service. Most people don't do something like that. Yes, it's vogue right now to speculate that what you're doing right now could suddenly become illegal in a new administration, but if that happens tomorrow, most of us would be one of hundreds of thousands who are all in the same boat. For that reason, most of us won't get targeted retroactively for behaviors that were legal at the time, and we have the option to reevaluate our security posture when the political landscape changes. But yeah, if you're actively speculating about starting an illegal service today, you should definitely have a better security posture than Ulbricht did.

cekanoni 2y ago

Headline feels like a click bait :)

bufferoverflow 2y ago

CloudFlare has the actual IP address that viewed the image. Which means some powerful (or rich enough) actors can get it. This is very very bad.

cthalupa 2y ago
This was... always, the case though? For any CDN service? How do you serve traffic to people without knowing where to send it?
- bufferoverflow 2y ago
  Onion protocol.
- endofreach 2y ago
  Agree. Though a valid concern might be that a victim uses signal because of E2EE, thinking no 3rd party involved in delivery, not knowing/thinking about a CDN used.

iforgot22 2y ago

Looks like it's possible to hit 2 datacenters due to load-balancing, which would narrow it down a bit more. Suppose you do this repeatedly as the target is moving around, hitting even more datacenters.

antidamage 2y ago

Imagine sending a friend request to bin Laden's videographer and getting a reply from Pakistan while your entire military is looking for him in Afghanistan? There's definitely cases where this is going to be immediately used. Shit, just using it to scrape Cloudflare for additional metadata on everyone from other user table leaks is probably valuable data. Even triangulation over time as they move around is going to get a more precise result. Maybe you find a vulnerability that takes that cloudflare node offline and run it again, repeat until you've got a fairly small radius they could be in.

KennyBlanken 2y ago

> cached in a data center near that user Not necessarily. Cloudflare is very upfront that they do not cache everything, and the time things are cached can vary greatly. The kid keeps talking about "deanonymization" and he has no idea what the term actually means.

nyclounge 2y ago

For that reason that's why federated setup such as matrix are better. It is much harder to deanonymiza a set of users on different servers in group chat.

TacticalCoder 2y ago

[dead]

jcul 2y ago

WhatsApp has an option to disable link previews. Surprised signal doesn't have this option. I only message people I know on Signal anyway. Edit: it seems signal does have the option

vdqtp3 2y ago
I had this same thought before reading the article - this isn't about link previews, it's about attachment caching
- mazambazz 2y ago
  But previewing can involve automatically loading resources. This "attack" is very similar to CSRF in that your exploit involves making the victim load a specific resource. That's why in secure mail clients, nothing but plaintext should be rendered, and an optional "Load all resources" button is shown for when you trust the sender, and want to load any media elements that require HTTP onto your client. Signal could mitigate this with something similar, where it didn't load the image file AT ALL, and instead showed a message: <User> wants you to load an image from https://example.com/foo.png https://example.com/foo.png. Load image? > Yes > No
  - vdqtp3 2y ago
    The difference being is that it's not a resource controlled by the attacker, it's an attachment hosted by Signal. But yes, removing previews for everything would mitigate the issue.

jeffhuys 2y ago

Did you see the GIF? It's able to triangulate.

tjoff 2y ago

Why does it need to be cached though? The only case where it might be downloaded more than once is if the user has multiple clients. Not that common and still very little traffic.

rkagerer 2y ago

[dupe]

rkagerer 2y ago
[dead]

rkagerer 2y ago

Caching attachments at a single nice, big, juicy honeypot like CloudFlare is one of the reasons Signal's privacy guarantees don't feel totally solid to me. I get that it's pragmatic, but feel there must be a better way. Does the caching occur even if both users are online when the attachment is sent?

Gasp0de 2y ago

Why would cloudflare ever operate a data center that only one user at a time is ever near?

BodyCulture 2y ago

You underestimate the value of this piece of information taken at different times. It can be enough to know in which country a person was yesterday or is today.