Messenger billed as better than Signal is full of vulnerabilities

Messenger billed as better than Signal is full of vulnerabilities

Messenger billed as better than Signal is full of vulnerabilities

Getty Images

Academic researchers have discovered serious vulnerabilities at the core of Threema, an instant messenger that the Switzerland-based developer says offers a level of security and privacy “no other chat service” can offer. Despite the unusually strong claims and two independent security audits Threema has received, the researchers said the flaws completely undermine the assurances of confidentiality and authentication that are the cornerstone of any program sold as providing end-to-end encryption, commonly abbreviated to E2EE.

Threema has more than 10 million users, which include the Swiss government, the Swiss army, German Chancellor Olaf Scholz and other politicians in that country. Threema developers advertise it as a more secure alternative to Meta’s WhatsApp messenger. It is among the best Android apps for a fee-based category in Switzerland, Germany, Austria, Canada and Australia. The app uses a specially designed encryption protocol contrary to established cryptographic norms.

The Seven Deadly Flaws

Researchers from the Zurich-based ETH research university reported on Monday that they found seven vulnerabilities in Threema that seriously call into question the true level of security the app has offered over the years. Two of the vulnerabilities do not require any special access to a Threema server or app to cryptographically impersonate a user. Three vulnerabilities require an attacker to gain access to a Threema server. The remaining two can be exploited when an attacker gains access to an unlocked phone, for example at a border crossing.

A diagram showing the three threat models for the attack: when an attacker has access to (1) the network communication, (2) the Threema servers, and (3) the victim device itself.
Magnify / A diagram showing the three threat models for the attack: when an attacker has access to (1) the network communication, (2) the Threema servers, and (3) the victim device itself.

Paterson et al.

“Overall, our attacks seriously undermine Threema’s security requirements,” the researchers wrote. “All of the attacks can be mitigated, but in some cases a major redesign is required.”

See also  Anonymous hacked Russian Yandex taxi app causing massive traffic jams

The seven vulnerabilities the researchers uncovered include:

  1. External actor with no special access
    1. In case a volatile key is exposed even once, an attacker can permanently impersonate the client to the server and then obtain all metadata in all E2EE messages. This is a notable shortcoming because volatile keys should never be able to authenticate a user. With Threema, leaking a volatile key has the same effect as leaking a long-term key. Sloppy key management also causes Threema to reuse volatile keys in places they should never be reused.
    2. A flaw in the way Threema’s client-to-server (C2S) protocol interacts with its end-to-end (E2E) protocol that causes a user to create a special Threema value known as a voucher box and send it to the attacker . The attacker can exploit it by tricking a user into sending a set of characters (u9j6’jjخЙ^ 1hW:-́;ܡRA) to a special but harmless account. One possible way for an attacker to do this is to spam a large number of users asking them to send the string of characters to a specific account to be eligible for a prize. From that point, the attacker can impersonate the hacked client to the server.
      Attack 1.2 in practice: on the left, a suitable key pair that is base64 encoded.  The public key bytes 1 to 31, also encoded in the QR code, all consist of printable UTF-8 characters.  On the right, the *LYTAAAS Threema gateway account (since revoked), with the hijacked public key of the server.  User U sending the content of the QR to *LYTAAAS as a message will allow *LYTAAAS to authenticate to Threema as U.
      Magnify / Attack 1.2 in practice: on the left, a suitable key pair that is base64 encoded. The public key bytes 1 to 31, also encoded in the QR code, all consist of printable UTF-8 characters. On the right, the *LYTAAAS Threema gateway account (since revoked), with the hijacked public key of the server. User U sending the content of the QR to *LYTAAAS as a message will allow *LYTAAAS to authenticate to Threema as U.
      A figure showing the cross-protocol interaction of an E2E and a C2S session.  The attacker claims the public key of the server and knows a key pair of the form (z, Z = 0x01 ∥ σ ∥ 0x01).  They convince the victim U to send σ to them as an E2E text message (in blue, left side).  The attacker can now start a session with the C2S protocol (right side) where they use it
      Magnify / A figure showing the cross-protocol interaction of an E2E and a C2S session. The attacker claims the public key of the server and knows a key pair of the form (z, Z = 0x01 ∥ σ ∥ 0x01). They convince the victim U to send σ to them as an E2E text message (in blue, left side). The attacker can now start a session with the C2S protocol (right side) where they use the “volatile” key pair (z, Z) and the corresponding voucher box EK2 (Z) (in blue) to authenticate as U to the server.
  2. When an attacker has compromised a Threema server:
    1. Lack of integrity protection on the message’s metadata. As a result, an attacker can covertly rearrange and/or delete messages sent from one client to another.
    2. Unhandled misuse allows “replay and reflection” attacks, where the threat actor resends old messages and sends a user a message that the user previously sent to someone else.
    3. A flaw in the challenge-and-response protocol used for a client to authenticate to the server during registration. During the process, the client proves possession of its private key by encrypting a server-selected message that is encrypted with a server-selected public key. A compromised server can exploit this design to create “kompromat” or potentially incriminating messages that can be delivered to a targeted user at any later time. Threema patched this vulnerability in December 2021, when its own researcher discovered it.
  3. When an attacker gains access to an unlocked phone running Threema:
    1. A feature that allows users to export their private key from one device to another. Poor design decisions make it trivial for an attacker to use the key to clone a Threema account and continue to access all future messages. Combined with a compromised Threema server, the adversary can also obtain all previously sent messages.
    2. Message compression that occurs before encryption when Threema creates a backup, combined with the ability for an attacker to use a nickname function to inject selected strings into the backup. This allows a more sophisticated attacker to observe the size of the backup file over multiple iterations and eventually recover the user’s private key.
See also  How to use Vanish Mode on Facebook Messenger
The composition of the end-to-end and client-to-server protocol.  Each client establishes a secure channel with the server using the C2S protocol (in yellow) to send and receive E2E encrypted messages from other users, which are forwarded via the server (the connection in green).
Magnify / The composition of the end-to-end and client-to-server protocol. Each client establishes a secure channel with the server using the C2S protocol (in yellow) to send and receive E2E encrypted messages from other users, which are forwarded via the server (the connection in green).

You may also like...

Leave a Reply

Your email address will not be published. Required fields are marked *