The developers of the popular privacy-focused messaging application Signal have rushed to patch a serious vulnerability in the Android version that can be exploited by an attacker to eavesdrop on users.
The flaw, tracked as CVE-2019-17191, was discovered by Google Project Zero researcher Natalie Silvanovich. The issue was reported to Signal developers in late September and it was patched very quickly with the release of version 4.47.7 for Android.
The vulnerability can be exploited by using a specially crafted Signal client. The client initiates an audio call to the targeted user, and once it starts ringing, the attacker presses the audio mute button on their end, which forces the called device to answer the call.
Silvanovich noted in her bug report that the attacker cannot force the application to answer a video call.
The issue also impacts the iOS version of Signal. However, the researcher points out that on iOS “the call is not completed due to an error in the UI caused by the unexpected sequence of states.” Silvanovich recommends “improving the logic in both clients, as it is possible the UI problem doesn't occur in all situations.”
After details of the bug were made public, Signal’s creator, Moxie Marlinspike, noted on Twitter that the exploit does not allow an attacker to silently enable the targeted device’s microphone — the victim would see on the screen that there is an ongoing call, and the call is logged in Signal’s list of conversations.
In a separate bug report, Silvanovich ..
Support the originator by clicking the read the rest link below.
