this post was submitted on 26 Nov 2023
267 points (94.9% liked)

Privacy

31833 readers
285 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Related communities

Chat rooms

much thanks to @gary_host_laptop for the logo design :)

founded 5 years ago
MODERATORS
 

When I press on some message to forward it, it shows me Random usernames of contacts I don't know. And it even shows some Mobile Numbers I don't know. For example, one number starts with +964 that's Iraq. I'm from Europe tho. These contacts and numbers are from all over the place.

Edit: This only happens on Signal Desktop. If I try to forward a message on Android it only shows my Contacts. And none of these unkown ones.

top 50 comments
sorted by: hot top controversial new old
[–] ripe_banana@lemmy.world 154 points 11 months ago* (last edited 11 months ago) (1 children)

For all of our safety, consider submitting a bugreport.

[–] ErKaf@feddit.de 48 points 11 months ago (5 children)

Thanks for the Link. I submitted a report.

load more comments (5 replies)
[–] hersh@literature.cafe 41 points 11 months ago (3 children)

Has anyone else been able to reproduce this? I just tried and was not able to.

OP, is it possible these people were in group chats you were part of?

[–] aodhsishaj@lemmy.world 13 points 11 months ago (1 children)

I still don't see any bug report anyone can follow up on.... I cannot trust OP's experience until that's linked here.

[–] ErKaf@feddit.de 7 points 11 months ago

The bug report forum from Signal doesn't give you any link.

[–] ErKaf@feddit.de 10 points 11 months ago (1 children)

No, they are not. I'm in two groups. None of them are in the groups. I only use Signal for Real life friends from my Country. I never joined any random group. These people are from all over the world.

[–] hersh@literature.cafe 4 points 11 months ago (1 children)

Interesting. Are there any other accounts on your phone that provide contacts? Maybe social media or other chat platforms? On Android you can see accounts in Settings > Passwords & Accounts (or somewhere similar; it varies a little between brands). You can also check inside your Contacts app by expanding the sidebar (again, varies by brand).

Just a thought. I don't have any other contact providers on my phone so I can't test it myself.

Please keep us posted if you get any official response or learn anything new!

[–] ErKaf@feddit.de 6 points 11 months ago

Nope. And I maybe had to add (did it now) that this only appears to be a problem with Signal Desktop. My signal app on android doesn't even show other contacts from strangers. I will update this if I get a response, of course.

[–] Pantherina@feddit.de 4 points 11 months ago

Group chats very likely. There are often sync issues from mobile, so these may just be old spam or group chat numbers.

[–] ErKaf@feddit.de 41 points 11 months ago

I just counted. Signal leaked 56 random people to me.

[–] Atemu@lemmy.ml 33 points 11 months ago

Could it be that these are spam numbers that tried to reach you at some point but were blocked before they could?

[–] Templa@beehaw.org 21 points 11 months ago

Why did someone see that I joined Signal? People who already know your number and already have you in their contacts see that they can contact you on Signal. Nothing is sent to them by your Signal app or the Signal service. They just see a number they know is registered. If someone knows how to send you an insecure SMS, we want them to see that they can send you a Signal message instead.

Why did I see that my contact joined Signal? You are notified when someone that is stored in your contact list is a new Signal user. If you can send an insecure SMS to a contact, we want you to know you can send a Signal message instead.

I hate this.

[–] elias_griffin@lemmy.world 18 points 11 months ago* (last edited 11 months ago) (1 children)

Huge if true! You could conceivably submit your phone to a Cybersecurity company and share in any reward.

Help us with:

  • Your OS Version
  • OS settings that are possibly related
  • How you obtained Signal
  • Signal version
  • Video proof
  • Steps to reproduce

Who knows how to compute a hash for an installed mobile phone app? We need to compare it with legit.

[–] ErKaf@feddit.de 10 points 11 months ago (10 children)

https://imgur.com/a/a6CQSpA

The video proof. It also shows the OS and Steps to reproduce. How I obtained Signal: Flathub Signal Version: 6.38.0 OS Settings: Nothing relevant.

[–] filcuk@lemmy.zip 3 points 11 months ago

Wicked, thanks for sharing

[–] pkill@programming.dev 3 points 11 months ago* (last edited 11 months ago) (1 children)

I advise you stop using Signal Desktop immediately, they keep the database key in plaintext. Exposed over 5 years ago and still not fixed. Frankly I find this pretty pathetic. Making this safer could be as simple as encrypting such files with something like age and perhaps regenerate the keys on a frequent basis (yes I know full disk encryption is somehow a viable solution against unwanted physical access. But instead, they'd rather focus on security by network effect by adding shiny UX features instead of fixing infrastructural stuff, like improving trust by decentralization, not requiring phone numbers to join, or adding support for app pasphrase (which is available in case of Molly, along with regular wiping of RAM data which makes things like cold boot or memory corruption attacks harder)

[–] ErKaf@feddit.de 4 points 11 months ago (2 children)

There is nothing more that I hate then typing on my Phone. I can't life without Signal Desktop.

[–] pkill@programming.dev 2 points 11 months ago

maybe try setting up a matrix bridge if you feel confident you can secure that properly. On one hand it might increase attack surface (use only servers and bridges with End to Bridge Encryption) but what's an attack surface on software that is so ridiculously compromised. Also you can try using an alternative client such as Flare. Though YMMV, for me the last time I've used it it was quite rough around the edges but I'm happy to see it's actively maintained so might be worth checking out.

Also no, flatpak doesn't fix this issue. Yeah it provides some isolation which can be further improved with flatseal, and other defense-in-depth methods. But unless you are willing to face the trade-offs of using Qubes, you won't compartmentalize your entire system. The key file in question is stored in ~/.local/share. I'm not denying vulnerabilities in userland applications, but thanks to it's wide reach, often massive codebases and use of unsafe languages like C, it's the core system or networked software that is the most common attack vector. And that doesn't ship and will never ship via flatpak.

The most obvious way this is exploitable is directory traversal. But not only that. Just look up "Electron $VULNERABILITY", be it CSRF, XSS or RCE. Sandbox escape is much easier with this crap than any major browser, since contextIsolation is often intentionally disabled to access nodejs primitives instead of electron's safer replacements. Btw Signal Desktop is also an electron app.

load more comments (1 replies)
[–] elias_griffin@lemmy.world 1 points 11 months ago* (last edited 11 months ago)

This is super helpful, I may post this to infosec.exchange. Flathub makes this so much more difficult to find the reason for what looks like a real breach. I don't use Flathub for security reasons so I don't know if you can even isolate the PID? Anyone know?

I don't want you to have to spend a lot of time or troubleshoot over the web but if you see anything that stands out as "wow shouldn't be there/running" when you run these commands come back to us:

  1. ps the PID of Signal or secondarily, Flathub
  2. lsof -p PID
  3. strace
    • sudo strace -f -t -e trace=file -p PID
  4. sysctl kernel.randomize_va_space
    • pkill/killall Flathub/Signal and restart FH/Signal and see if it still presents the vulnerability
load more comments (7 replies)
[–] possiblylinux127@lemmy.zip 12 points 11 months ago (1 children)

I've been getting spam on signal. I wonder if this is how they got my number

load more comments (1 replies)
[–] Katzastrophe@feddit.de 11 points 11 months ago (1 children)

Wtf is happening in these comments

[–] ErKaf@feddit.de 6 points 11 months ago (1 children)
[–] possiblylinux127@lemmy.zip 2 points 11 months ago (1 children)
[–] BearOfaTime@lemm.ee 10 points 11 months ago

Noticed in one of your comments this is happening on Signal desktop. Is this a windows machine? Maybe update your post so people are aware it's no on Android

[–] LWD@lemm.ee 7 points 11 months ago* (last edited 10 months ago) (1 children)
[–] ErKaf@feddit.de 24 points 11 months ago

56 different numbers from all over the world, and all of them are actually real and have signal? I doubt I accidentally do something like this haha :)

[–] pkill@programming.dev 7 points 11 months ago (2 children)
[–] Ohh@lemmy.ml 18 points 11 months ago (4 children)

My confidence in signal is greater than my confidence in a random fork. Privacy is hard... So I feel it's better to trust something less than ideal, than to trust a random dude promising to solve all problems...

That's just my threat model.

[–] pkill@programming.dev 4 points 11 months ago* (last edited 11 months ago)

Also don't get me wrong. Molly might be written by less experienced programmers. And if it was written from scratch, it could be very likely it would contain more vulnerabilities per 1000 lines of code than standard Signal app. But it's mostly just it's a hardened superset sans some nasty stuff. I'd compare that more to how Calyx or GrapheneOS are to plain AOSP than how some low maintenance random custom ROM from XDA with fuckton of bells and whistles that will leave your bootloader unlocked is.

load more comments (3 replies)
[–] ErKaf@feddit.de 7 points 11 months ago

Its not a problem with the Android App.

[–] Natanael@slrpnk.net 5 points 11 months ago
load more comments
view more: next ›