Signal says there is no evidence rumored zero-day bug is real | Hacker News Reader

Signal says there is no evidence rumored zero-day bug is real

bleepingcomputer.com

88 pointsWasserpuncher24 comments

The author of the linked tweet has retracted it.[0]

[0] https://twitter.com/gaughen/status/1713792849269997687)

https://nitter.net/gaughen/status/1713792849269997687

> I spend my life fighting disinformation online, so I always regret when I accidentally spread it. My apologies.

So.... what did this person do to verify the information before sharing it? Since they 'spend their life' fighting disinformation, surely they didn't just retweet it blindly? Right?

It's not the first piece of disinformation he's spread, and it won't be the last. He claims that he fights disinformation to make his own spreading of it seem like a sincere mistake when he's caught out.

I mean the proposed mitigation is just common sense and should have been enabled (i.e. the feature disabled) anyway.

Generating a "link preview" involves invoking some sort of browser engine to some degree, so "has a zero-day vulnerability" is virtually guaranteed to be true, whether or not you have a report of a concrete exploit.

No you don't need a browser engine. You just need a basic HTML parser that understands OG meta tags.

> This statement comes after numerous sources told BleepingComputer and reported on Twitter that a new zero-day vulnerability allowed for a full takeover of devices.

If that were true, it wouldn't only be a Signal vulnerability, but also one of Android/iOS.

blogspam for https://twitter.com/signalapp/status/1713789257599353084

I was really impressed with Signal’s choice to add link previews to my secure chats. It struck me as a feature with nothing but upside for a security-and-privacy focused messaging app.

I am glad to be reassured that fetching data from arbitrary servers inside of a secure chat continues to be worth the benefit of being able to see a little thumbnail of a page.

The mitigation was to go into settings and disable image preview. I imagine many privacy/security-conscious HN's already have that setting disabled.

But, as a bunch of people pointed out when that meme started spreading, link previews in Signal are generated by the sender, for privacy reasons, so this never really made all that much sense.

It would make sense if the alleged exploit targeted the sender, no?

"We have no evidence" is one thing, but a report on the fuzz testing the link preview feature has undergone would be more reassuring.

To be fair, they did (as the article states) check with the supposed source and confirm the source was unaware of the bug, they proposed a mitigation if you want to be cautious till the bug is confirmed to not exist, and they're investigating further.

Sounds like a version of the WebP bug that abuses link previews to display the image maybe?

When I heard about this, I also associated the two. The report talks about link preview generation, so it sounded like someone could put a webp on the social metadata of a page for link previews, and then send it as a malicious payload.

But that would mean any app with link preview (eg. slack, whatsapp, discord) would also be affected...

Nothing in the linked article even remotely suggests that.

Signal patched WebP weeks ago.

How can a bug that doesn't exist sound like anything?

If it were anyone other than Signal:

Today's headline: We Have No Evidence $Product Is Vuln

Tomorrow's headline: Hacker Releases Data Dump From $Product

Not necessarily - see the recent bogus curl CVE's for instance. There's a lot of incentives to invent or embellish vulnerabilities for street cred or other reasons.

Many years ago, a 'researcher' made claims to the media that our product had a zero-day that looked like a deliberate backdoor. They refused to tell us anything about the bug.

What kind of cred does the street give for making stuff up and posting about something that doesn't work? Seems like that would be one of those things where nature takes care of itself by weeding out these players.

An embellishment can often be put down to a difference of opinion, and vendors have a reputation for downplaying vulnerabilities.

In our case, the media reported the researcher's claims uncritically alongside our denials. We decided the best strategy was to say as little as possible, as saying or doing more wouldn't improve the quality of the reporting and would only risk drawing more attention to the false claims.

I think we had a good track record of handling vulnerabilities well, and we definitely had some nasty ones. But this was not one of them.

> We also checked with people across US Government, since the copy-paste report claimed USG as a source. Those we spoke to have no info suggesting this is a valid claim

Well yes, of course they said that, they're not going to disclose their million-dollar zero-days to you are they.

Reply on news.ycombinator.com