Almost every application contains security vulnerabilities, some of which you may find today, but others would remain invisible until someone else finds and exploits them—which is the harsh reality of cybersecurity and its current state.
And when we say this, Signal Private Messenger—promoted as one of the most secure messengers in the world—isn’t any exception.
Google Project Zero researcher Natalie Silvanovich discovered a logical vulnerability in the Signal messaging app for Android that could allow malicious caller to force a call to be answered at the receiver’s end without requiring his/her interaction.
In other words, the flaw could be exploited to turn on the microphone of a targeted Signal user’s device and listen to all surrounding conversations.
However, the Signal vulnerability can only be exploited if the receiver fails to answer an audio call over Signal, eventually forcing the incoming call to be automatically answered on the receiver’s device.
“In the Android client, there is a method handleCallConnected that causes the call to finish connecting. During normal use, it is called in two situations: when the callee device accepts the call when the user selects ‘accept,’ and when the caller device receives an incoming “connect” message indicating that the callee has accepted the call,” Silvanovich explains in the Chromium blog.
“Using a modified client, it is possible to send the “connect” message to a callee device when an incoming call is in progress but has not yet been accepted by the user. This causes the call to be answered, even though the user has not interacted with the device.”
To be noted, “the connected call will only be an audio call, as the user needs to manually enable video in all calls.”
images from Hacker News