Signal fixes location-revealing flaw, introduces Signal PINs

guest · May 21, 2020

Signal registration lock stops your account being hijacked on a new phone
May 21, 2020
https://9to5mac.com/2020/05/21/signal-registration-lock/

Secure messaging app Signal has added a new level of protection in the latest version. Signal registration lock won’t allow anyone to register your phone number on a new phone without a PIN …

Signal already requires a code sent via text message to register a phone number, but there are a variety of vulnerabilities in the SMS system which mean this isn’t a completely secure system. One common one is known as a SIM-swap attack.

An alarming test carried out by Princeton shows that the five largest US carriers fail to properly protect their customers against so-called SIM-swap attacks. [...]
This is the reason Signal is introducing an additional layer of protection, which requires you to enter a PIN as well as the SMS code.
Click to expand...

You can, however, reset the PIN on your registered device without having to know it: the PIN is only designed to protect against your phone number being assigned to a new device.
Click to expand...

Signal: Signal PINs

Signal PINs are needed to support new features and they serve as an optional registration lock.
Click to expand...

guest · May 22, 2020

Signal fixes location-revealing flaw, introduces Signal PINs
May 21, 2020
https://www.helpnetsecurity.com/2020/05/21/signal-pins/

Signal has fixed a vulnerability affecting its popular eponymous secure communications app that allowed bad actors to discover and track a user’s location.
The non profit organization has also announced on Tuesday a new mechanism – Signal PINs – that will, eventually, allow users not to use their phone number as their user ID.
About the vulnerability
The vulnerability, discovered by Tenable researcher David Wells, stems from the fact that the WebRTC fork used by Signal for voice and video communication must discover a valid connection path for the local (the calling party) and remote peer (the called party) to communicate.
[...] Most importantly, the information can be gleaned even if the called party does not answer the call, meaning that the called party can’t prevent a threat actor from placing the call, hanging up before they answer, and collect the DNS server info.

While this may not be a problem for average users, one can see how certain users like journalists, activists, dissidents, or even victims of stalkers could be affected by malicious actors being able to know, at any time, their general location.
Click to expand...

About Signal PINs
By setting up and using a Signal PIN, users will be able to save (backup) important data (e.g., profile, account settings, contacts, block list) that they might lose if their phones get lost, stolen or destroyed. This will also allow users to easily migrate their Signal data when they switch phones.

The data will be encrypted and saved on Signal’s servers, but won’t be accessible to Signal because they don’t know the users’ PIN.
Click to expand...

Tenable researcher David Wells: Abusing WebRTC to Reveal Coarse Location Data in Signal

UPDATED 5/20/2020: The blog post was updated to reflect the availability of updated versions of Signal on the Google Play Store and Apple App Store.

So this month, when I disclosed a way to leak a user’s DNS server simply by ringing their Signal number (CVE-2020–5753), I was happy to see how fast they patched it. Revealing a Signal user’s DNS server can potentially reveal coarse location
[...] For certain Signal users, this issue could be quite serious, while average users aren’t as likely to be impacted. It’s worth mentioning that this is not an issue in Signal’s code, but due to WebRTC doing DNS requests.
Click to expand...

Signal: Introducing Signal PINs

In the latest version of our apps, we’re introducing Signal PINs. Signal PINs are based on Secure Value Recovery, which we previewed in December, to allow supporting data like your profile, settings, and who you’ve blocked to be securely recovered should you lose or switch devices.
Signal PINs are at least 4 digits, but they can also be longer or alphanumeric if you prefer.
Click to expand...

Log in or Sign up

Signal fixes location-revealing flaw, introduces Signal PINs

guest Guest

guest Guest

Log in or Sign up

Signal fixes location-revealing flaw, introduces Signal PINs

guest Guest

guest Guest

Useful Searches