.png)
Almost every application contains security vulnerabilities, some of which you may find today, but others would remain invisible until someone else finds and exploits them—which is the harsh reality of cybersecurity and its current state.
And when we say this, Signal Private Messenger—promoted as one of the most secure messengers in the world—isn’t any exception.
Google Project Zero researcher Natalie Silvanovich discovered a logical vulnerability in the Signal messaging app for Android that could have allowed a caller to force a call to be answered at the receiver’s end without requiring his/her interaction.
In other words, the flaw could have allowed attackers to simply turn on the microphone of a targeted Signal user’s device and listen to all conversations surrounding the phone.
However, it should be noted that the Signal vulnerability can only be exploited if the receiver fails to answer an audio call over Signal, eventually forcing the incoming call to be automatically answered on the receiver’s device.
“In the Android client, there is a method handleCallConnected that causes the call to finish connecting. During normal use, it is called in two situations: when the callee device accepts the call when the user selects ‘accept,’ and when the caller device receives an incoming “connect” message indicating that the callee has accepted the call,” Silvanovich explains in the Chromium blog.
“Using a modified client, it is possible to send the “connect” message to a callee device when an incoming call is in progress but has not yet been accepted by the user. This causes the call to be answered, even though the user has not interacted with the device.”
To be noted, “the connected call will only be an audio call, as the user needs to manually enable video in all calls.”
Silvanovich also mentioned that “Signal has this large remote attack surface due to limitations in WebRTC,” and the design flaw also affects the iOS version of the messaging app, but can not be exploited because “the call is not completed due to an error in the UI caused by the unexpected sequence of states.”
Silvanovich reported this vulnerability to the Signal security team last month. The company acknowledged the issue and patched it in the latest Android version of Signal Private Messenger.
What’s your take? Let me write it down for you again—go and update the Signal Private Messenger app on your Android phone from Google Play Store and make sure you always run up-to-date apps.
