#HITB2017AMS D2T1 - Hunting For Vulnerabilities In Signal

### Overview In this talk presented at HITB 2017 Amsterdam, Markus Vervier (along with co-researcher JP Aumasson / Jean-Philippe Aumasson) presents security research into the Signal messaging app and protocol. The researchers set out to evaluate Signal’s code base, attack surface, protocol mechanics, and implementation specifics, primarily focusing on the Android client, the Chrome desktop extension, and the underlying C/Java libraries.

### Key Topics - **Signal Architecture and Attack Surface**: While Signal guarantees end-to-end encryption using the Double Ratchet and X3DH protocols (licensed and used in WhatsApp, Facebook Messenger, and Google Allo), the actual application attack surface is massive. The Android client encompasses hundreds of thousands of lines of code, third-party libraries (such as WebRTC and OpenSSL), and system media decoders with no privilege separation or sandboxing between media parsers and core messaging logic. - **Threat Models**: The researchers evaluated two primary attack scenarios: a classical active/passive network attacker (or compromised Signal server) and a malicious communicating peer who holds valid encryption keys and can deliver arbitrary media payloads directly to parsing components. - **Manual Audit Approach**: Rather than relying on rigorous formal verification or automated tooling, the researchers performed manual code analysis focusing on data flows, edge cases, language-specific bug classes, and protocol boundary handling.

### Technical Details - **Attachment Integrity MAC Bypass**: An integer overflow vulnerability was identified in the Android attachment validation logic. When calculating remaining attachment data to authenticate with HMAC, the length of the MAC is subtracted from the file length using a 32-bit signed integer. By appending 4 GB of padding (compressed via HTTP content encoding down to 2–4 MB during transit), the integer wraps around. As a result, only the initial bytes are checked by the MAC, while remaining manipulated bytes are processed. Combined with AES-CBC malleability, this allows block duplication and plaintext alteration without triggering integrity check failures. - **Cryptographic Quirks**: Setting the public key to zero results in a shared secret of zero in Signal's implementation, producing predictable secrets and undermining break-in recovery properties. Furthermore, example C code provided with the Signal library contained flaws including type confusions and integer/heap overflows. - **Denial of Service and Parsing Issues**: In the RTP calling code, missing bounds checks on packet headers caused an underflow leading to out-of-bounds reads and remote crashes. In Android, feeding malformed media triggered crashes in `libskia` that caused continuous reboot-crash loops on devices like the Nexus 7. In the Chrome extension, a crafted SVG image could crash the renderer process via out-of-memory errors. - **Protocol Message Replay Attack**: Signal handles asynchronous communication using pre-keys, including a persistent 'last resort' medium-term key. Bundled messages contain an encrypted ciphertext alongside unauthenticated key exchange metadata. Because the key exchange parameters are not MAC-protected and the client only tracks 40 concurrent session states, an active man-in-the-middle attacker can inject modified key exchange parameters across 40 messages to evict legitimate sessions from the session store. Once the original session state is purged, the attacker can replay a previously recorded message using the last resort pre-key, causing the recipient to accept and decrypt the replayed message again. - **Localhost HTTP Audio Streaming**: On Android, incoming audio attachments were written out and streamed unencrypted via a local HTTP server on `localhost` over a random port to the Android media player, potentially exposing audio data if the ephemeral URI is leaked.

### Takeaways Secure messaging relies heavily on more than cryptographic design. The large code footprint, lack of sandboxing for third-party media parsers, and implementation bugs in protocol handling expose trusted applications to memory corruption, denial of service, and message replay attacks.