{"id":182709,"date":"2023-01-10T15:41:05","date_gmt":"2023-01-10T15:41:05","guid":{"rendered":"https:\/\/harchi90.com\/messenger-billed-as-better-than-signal-is-riddled-with-vulnerabilities\/"},"modified":"2023-01-10T15:41:05","modified_gmt":"2023-01-10T15:41:05","slug":"messenger-billed-as-better-than-signal-is-riddled-with-vulnerabilities","status":"publish","type":"post","link":"https:\/\/harchi90.com\/messenger-billed-as-better-than-signal-is-riddled-with-vulnerabilities\/","title":{"rendered":"Messenger billed as better than Signal is riddled with vulnerabilities"},"content":{"rendered":"<div itemprop=\"articleBody\">\n<figure class=\"intro-image intro-left\">\n  <figcaption class=\"caption\">\n<p>Getty Images<\/p>\n<\/figcaption><\/figure>\n<aside id=\"social-left\" class=\"social-left\" aria-label=\"Read the comments or share this article\">\n<\/aside>\n<p><!-- cache miss 88:single\/related:744bd2eaacc9910b3b750e4d695c7643 --><!-- empty --><\/p>\n<p>Academic researchers have discovered serious vulnerabilities in the core of Threema, an instant messenger that its Switzerland-based developer says provides a level of security and privacy \u201cno other chat service\u201d can offer.  Despite the unusually strong claims and two independent security audits Threema has received, the researchers said the flaws completely undermine assurances of confidentiality and authentication that are the cornerstone of any program sold as providing end-to-end encryption, typically abbreviated as E2EE.<\/p>\n<p>Threema has more than 10 million users, which include the Swiss government, the Swiss army, German Chancellor Olaf Scholz, and other politicians in that country.  Threema developers advertise it as a more secure alternative to Meta&#8217;s WhatsApp messenger.  It&#8217;s among the top Android apps for a fee-based category in Switzerland, Germany, Austria, Canada, and Australia.  The app uses a custom-designed encryption protocol in contravention of established cryptographic norms.<\/p>\n<h2>The seven deadly flaws<\/h2>\n<p>Researchers from the Zurich-based ETH research university reported on Monday that they found seven vulnerabilities in Threema that seriously call into question the true level of security the app has offered over the years.  Two of the vulnerabilities require no special access to a Threema server or app to cryptographically impersonate a user.  Three vulnerabilities require an attacker to gain access to a Threema server.  The remaining two can be exploited when an attacker gains access to an unlocked phone, such as at a border crossing.<\/p>\n<figure class=\"image shortcode-img center large\" style=\"width:100%\"><img loading=\"lazy\" alt=\"A diagram showing the three threat models for the attack: when an attacker has access to (1) the network communication, (2) the Threema servers, and (3) the victim device itself.\" src=\"https:\/\/i0.wp.com\/cdn.arstechnica.net\/wp-content\/uploads\/2023\/01\/threat-models-640x346.jpg?resize=640%2C346&#038;ssl=1\" width=\"640\" height=\"346\" srcset=\"https:\/\/cdn.arstechnica.net\/wp-content\/uploads\/2023\/01\/threat-models.jpg 2x\" data-recalc-dims=\"1\"\/><figcaption class=\"caption\">\n<div class=\"caption-text\">enlarge <span class=\"sep\">\/<\/span> A diagram showing the three threat models for the attack: when an attacker has access to (1) the network communication, (2) the Threema servers, and (3) the victim device itself.<\/div>\n<p>Paterson et al.<\/p>\n<\/figcaption><\/figure>\n<p>\u201cIn totality, our attacks seriously undermine Threema&#8217;s security claims,\u201d the researchers wrote.  \u201cAll the attacks can be mitigated, but in some cases, a major redesign is needed.\u201d<\/p>\n<aside class=\"ad_wrapper\" aria-label=\"In Content advertisement\">\n    <span class=\"ad_notice\">Advertisement <\/span>    <\/p>\n<\/aside>\n<p>The seven vulnerabilities the researchers uncovered include:<\/p>\n<ol>\n<li aria-level=\"1\">External actors with no special access\n<ol>\n<li aria-level=\"2\">In the event an ephemeral key is exposed even once, an attacker can permanently impersonate the client to the server and then obtain all metadata in all E2EE messages.  This is a remarkable shortcoming because ephemeral keys should never be able to authenticate a user.  With Threema, leaking of an ephemeral key has the same effect as leaking a long-term key.  Sloppy key management also causes Threema to reuse ephemeral keys in places they should never be reused.<\/li>\n<li aria-level=\"2\">A flaw in the way Threema&#8217;s client-to-server (C2S) protocol interacts with its end-to-end (E2E) protocol that causes a user to create a special Threema value known as a vouch box and send it to the attacker.  The attacker can exploit it by tricking a user into sending a set of characters (u9j6\u07d3&#8217;jj\u0916\u053b^\u07c31\u05dbW:-\u0301;\u0721RA) to a special but innocuous account.  One possible way for an attacker to do this is to send spam to a large number of users that tells them to send the character string to a specific account in order to be eligible for a prize.  From that point on, the attacker can impersonate the hacked client to the server.<br \/>\n<figure class=\"image shortcode-img center large\" style=\"width:100%\"><img loading=\"lazy\" alt=\"Attack 1.2 in practice: on the left, a suitable keypair that is base64 encoded.  The public key bytes 1 to 31 , also encoded in the QR code, all consist of printable UTF-8 characters.  On the right, the *LYTAAAS Threema gateway account (since revoked), with the hijacked public key of the server.  User U sending the contents of the QR to *LYTAAAS as a message will allow *LYTAAAS to authenticate to Threema as the U.\" src=\"https:\/\/i0.wp.com\/cdn.arstechnica.net\/wp-content\/uploads\/2023\/01\/malicious-message-640x336.jpg?resize=640%2C336&#038;ssl=1\" width=\"640\" height=\"336\" srcset=\"https:\/\/cdn.arstechnica.net\/wp-content\/uploads\/2023\/01\/malicious-message.jpg 2x\" data-recalc-dims=\"1\"\/><figcaption class=\"caption\">\n<div class=\"caption-text\">enlarge <span class=\"sep\">\/<\/span> Attack 1.2 in practice: on the left, a suitable keypair that is base64 encoded.  The public key bytes 1 to 31 , also encoded in the QR code, all consist of printable UTF-8 characters.  On the right, the *LYTAAAS Threema gateway account (since revoked), with the hijacked public key of the server.  User U sending the contents of the QR to *LYTAAAS as a message will allow *LYTAAAS to authenticate to Threema as the U.<\/div>\n<\/figcaption><\/figure>\n<figure class=\"image shortcode-img center large\" style=\"width:100%\"><img loading=\"lazy\" alt=\"A figure showing the cross-protocol interaction of an E2E and a C2S session.  The attacker claims the public key of the server and knows a keypair of the form (z, Z = 0x01 \u2225 \u03c3 \u2225 0x01).  They convince the victim U to send \u03c3 to them as an E2E text message (in blue, Left side).  The attacker can now start a session of the C2S protocol (Right side) where they use the \u201cephemeral\u201d keypair (z, Z) and the corresponding vouch box EK2 (Z) (in blue) in order to authenticate as U to the server .\" src=\"https:\/\/i0.wp.com\/cdn.arstechnica.net\/wp-content\/uploads\/2023\/01\/vouch-box-forgery-640x339.jpg?resize=640%2C339&#038;ssl=1\" width=\"640\" height=\"339\" srcset=\"https:\/\/cdn.arstechnica.net\/wp-content\/uploads\/2023\/01\/vouch-box-forgery.jpg 2x\" data-recalc-dims=\"1\"\/><figcaption class=\"caption\">\n<div class=\"caption-text\">enlarge <span class=\"sep\">\/<\/span> A figure showing the cross-protocol interaction of an E2E and a C2S session.  The attacker claims the public key of the server and knows a keypair of the form (z, Z = 0x01 \u2225 \u03c3 \u2225 0x01).  They convince the victim U to send \u03c3 to them as an E2E text message (in blue, Left side).  The attacker can now start a session of the C2S protocol (Right side) where they use the \u201cephemeral\u201d keypair (z, Z) and the corresponding vouch box EK2 (Z) (in blue) in order to authenticate as U to the server .<\/div>\n<\/figcaption><\/figure>\n<\/li>\n<\/ol>\n<\/li>\n<li aria-level=\"1\">When an attacker has compromised a Threema server:\n<ol>\n<li aria-level=\"2\">A lack of integrity protection on the message metadata.  As a result, an attacker can surreptitiously reorder and\/or delete messages sent from one client to another.<\/li>\n<li aria-level=\"2\">Faulty usage nonce handling allows for \u201creplay and reflection\u201d attacks, in which the threat actor resends old messages and sends a user a message that user previously sent to someone else.<\/li>\n<li aria-level=\"2\">A bug in the challenge-and-response protocol used for a client to authenticate itself to the server during registration.  During the process, the client proves possession of its private key by encrypting a server-chosen message that&#8217;s encrypted with a server-chosen public key.  A compromised server can exploit this design to create \u201ckompromat,\u201d or potentially incriminating messages that can be delivered at any later time to a targeted user.  Threema patched this vulnerability in December 2021, when a separate researcher spotted it.<\/li>\n<\/ol>\n<\/li>\n<li aria-level=\"1\">When an attacker gains access to an unlocked phone running Threema:\n<ol>\n<li aria-level=\"2\">A feature that allows users to export their private key from one device to another.  Poor design decisions make it trivial for an attacker to use the key to clone a Threema account and go on to access all future messages.  Combined with a compromised Threema server, the adversary can also obtain all previously sent messages.<\/li>\n<li aria-level=\"2\">Message compression that occurs before encryption when Threema creates a backup, combined with the ability for an attacker to use a nickname feature to inject chosen strings into the backup.  This allows a more sophisticated attacker to observe the size of the backup file over multiple iterations and eventually recover the user&#8217;s private key.<\/li>\n<\/ol>\n<\/li>\n<\/ol>\n<aside class=\"ad_wrapper\" aria-label=\"In Content advertisement\">\n    <span class=\"ad_notice\">Advertisement <\/span>    <\/p>\n<\/aside>\n<figure class=\"image shortcode-img center large\" style=\"width:100%\"><img loading=\"lazy\" alt=\"The composition of the end-to-end and client-to-server protocol.  Each client establishes a secure channel with the server using the C2S protocol (in yellow) to send and receive E2E-encrypted messages from other users, which are relayed via the server (the connection in green).\" src=\"https:\/\/i0.wp.com\/cdn.arstechnica.net\/wp-content\/uploads\/2023\/01\/threema-e2ee-composition-640x328.jpg?resize=640%2C328&#038;ssl=1\" width=\"640\" height=\"328\" srcset=\"https:\/\/cdn.arstechnica.net\/wp-content\/uploads\/2023\/01\/threema-e2ee-composition.jpg 2x\" data-recalc-dims=\"1\"\/><figcaption class=\"caption\">\n<div class=\"caption-text\">enlarge <span class=\"sep\">\/<\/span> The composition of the end-to-end and client-to-server protocol.  Each client establishes a secure channel with the server using the C2S protocol (in yellow) to send and receive E2E-encrypted messages from other users, which are relayed via the server (the connection in green).<\/div>\n<\/figcaption><\/figure>\n<\/p><\/div>\n","protected":false},"excerpt":{"rendered":"<p>Getty Images Academic researchers have discovered serious vulnerabilities in the core of Threema, an instant messenger that its Switzerland-based developer says provides a level of security and privacy \u201cno other chat service\u201d can offer. Despite the unusually strong claims and two independent security audits Threema has received, the researchers said the flaws completely undermine assurances &hellip;<\/p>\n<p class=\"read-more\"> <a class=\"\" href=\"https:\/\/harchi90.com\/messenger-billed-as-better-than-signal-is-riddled-with-vulnerabilities\/\"> <span class=\"screen-reader-text\">Messenger billed as better than Signal is riddled with vulnerabilities<\/span> Read More &raquo;<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"default","ast-global-header-display":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","jetpack_publicize_message":"","jetpack_is_tweetstorm":false,"jetpack_publicize_feature_enabled":true},"categories":[4],"tags":[],"jetpack_publicize_connections":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v19.10 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Messenger billed as better than Signal is riddled with vulnerabilities - harchi90<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/news.google.com\/__i\/rss\/rd\/articles\/CBMifmh0dHBzOi8vYXJzdGVjaG5pY2EuY29tL2luZm9ybWF0aW9uLXRlY2hub2xvZ3kvMjAyMy8wMS9tZXNzZW5nZXItYmlsbGVkLWFzLWJldHRlci10aGFuLXNpZ25hbC1pcy1yaWRkbGVkLXdpdGgtdnVsbmVyYWJpbGl0aWVzL9IBggFodHRwczovL2Fyc3RlY2huaWNhLmNvbS9pbmZvcm1hdGlvbi10ZWNobm9sb2d5LzIwMjMvMDEvbWVzc2VuZ2VyLWJpbGxlZC1hcy1iZXR0ZXItdGhhbi1zaWduYWwtaXMtcmlkZGxlZC13aXRoLXZ1bG5lcmFiaWxpdGllcy9hbXAv?oc=5\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Messenger billed as better than Signal is riddled with vulnerabilities - harchi90\" \/>\n<meta property=\"og:description\" content=\"Getty Images Academic researchers have discovered serious vulnerabilities in the core of Threema, an instant messenger that its Switzerland-based developer says provides a level of security and privacy \u201cno other chat service\u201d can offer. Despite the unusually strong claims and two independent security audits Threema has received, the researchers said the flaws completely undermine assurances &hellip; Messenger billed as better than Signal is riddled with vulnerabilities Read More &raquo;\" \/>\n<meta property=\"og:url\" content=\"https:\/\/news.google.com\/__i\/rss\/rd\/articles\/CBMifmh0dHBzOi8vYXJzdGVjaG5pY2EuY29tL2luZm9ybWF0aW9uLXRlY2hub2xvZ3kvMjAyMy8wMS9tZXNzZW5nZXItYmlsbGVkLWFzLWJldHRlci10aGFuLXNpZ25hbC1pcy1yaWRkbGVkLXdpdGgtdnVsbmVyYWJpbGl0aWVzL9IBggFodHRwczovL2Fyc3RlY2huaWNhLmNvbS9pbmZvcm1hdGlvbi10ZWNobm9sb2d5LzIwMjMvMDEvbWVzc2VuZ2VyLWJpbGxlZC1hcy1iZXR0ZXItdGhhbi1zaWduYWwtaXMtcmlkZGxlZC13aXRoLXZ1bG5lcmFiaWxpdGllcy9hbXAv?oc=5\" \/>\n<meta property=\"og:site_name\" content=\"harchi90\" \/>\n<meta property=\"article:published_time\" content=\"2023-01-10T15:41:05+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/cdn.arstechnica.net\/wp-content\/uploads\/2023\/01\/broken-chain-760x380.jpg\" \/>\n<meta name=\"author\" content=\"islamlacoste58\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:image\" content=\"https:\/\/cdn.arstechnica.net\/wp-content\/uploads\/2023\/01\/broken-chain-760x380.jpg\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"islamlacoste58\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/harchi90.com\/messenger-billed-as-better-than-signal-is-riddled-with-vulnerabilities\/\",\"url\":\"https:\/\/news.google.com\/__i\/rss\/rd\/articles\/CBMifmh0dHBzOi8vYXJzdGVjaG5pY2EuY29tL2luZm9ybWF0aW9uLXRlY2hub2xvZ3kvMjAyMy8wMS9tZXNzZW5nZXItYmlsbGVkLWFzLWJldHRlci10aGFuLXNpZ25hbC1pcy1yaWRkbGVkLXdpdGgtdnVsbmVyYWJpbGl0aWVzL9IBggFodHRwczovL2Fyc3RlY2huaWNhLmNvbS9pbmZvcm1hdGlvbi10ZWNobm9sb2d5LzIwMjMvMDEvbWVzc2VuZ2VyLWJpbGxlZC1hcy1iZXR0ZXItdGhhbi1zaWduYWwtaXMtcmlkZGxlZC13aXRoLXZ1bG5lcmFiaWxpdGllcy9hbXAv?oc=5\",\"name\":\"Messenger billed as better than Signal is riddled with vulnerabilities - harchi90\",\"isPartOf\":{\"@id\":\"https:\/\/harchi90.com\/#website\"},\"datePublished\":\"2023-01-10T15:41:05+00:00\",\"dateModified\":\"2023-01-10T15:41:05+00:00\",\"author\":{\"@id\":\"https:\/\/harchi90.com\/#\/schema\/person\/0689156e87fbe869f0e5efdeef200d5b\"},\"breadcrumb\":{\"@id\":\"https:\/\/news.google.com\/__i\/rss\/rd\/articles\/CBMifmh0dHBzOi8vYXJzdGVjaG5pY2EuY29tL2luZm9ybWF0aW9uLXRlY2hub2xvZ3kvMjAyMy8wMS9tZXNzZW5nZXItYmlsbGVkLWFzLWJldHRlci10aGFuLXNpZ25hbC1pcy1yaWRkbGVkLXdpdGgtdnVsbmVyYWJpbGl0aWVzL9IBggFodHRwczovL2Fyc3RlY2huaWNhLmNvbS9pbmZvcm1hdGlvbi10ZWNobm9sb2d5LzIwMjMvMDEvbWVzc2VuZ2VyLWJpbGxlZC1hcy1iZXR0ZXItdGhhbi1zaWduYWwtaXMtcmlkZGxlZC13aXRoLXZ1bG5lcmFiaWxpdGllcy9hbXAv?oc=5#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/news.google.com\/__i\/rss\/rd\/articles\/CBMifmh0dHBzOi8vYXJzdGVjaG5pY2EuY29tL2luZm9ybWF0aW9uLXRlY2hub2xvZ3kvMjAyMy8wMS9tZXNzZW5nZXItYmlsbGVkLWFzLWJldHRlci10aGFuLXNpZ25hbC1pcy1yaWRkbGVkLXdpdGgtdnVsbmVyYWJpbGl0aWVzL9IBggFodHRwczovL2Fyc3RlY2huaWNhLmNvbS9pbmZvcm1hdGlvbi10ZWNobm9sb2d5LzIwMjMvMDEvbWVzc2VuZ2VyLWJpbGxlZC1hcy1iZXR0ZXItdGhhbi1zaWduYWwtaXMtcmlkZGxlZC13aXRoLXZ1bG5lcmFiaWxpdGllcy9hbXAv?oc=5\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/news.google.com\/__i\/rss\/rd\/articles\/CBMifmh0dHBzOi8vYXJzdGVjaG5pY2EuY29tL2luZm9ybWF0aW9uLXRlY2hub2xvZ3kvMjAyMy8wMS9tZXNzZW5nZXItYmlsbGVkLWFzLWJldHRlci10aGFuLXNpZ25hbC1pcy1yaWRkbGVkLXdpdGgtdnVsbmVyYWJpbGl0aWVzL9IBggFodHRwczovL2Fyc3RlY2huaWNhLmNvbS9pbmZvcm1hdGlvbi10ZWNobm9sb2d5LzIwMjMvMDEvbWVzc2VuZ2VyLWJpbGxlZC1hcy1iZXR0ZXItdGhhbi1zaWduYWwtaXMtcmlkZGxlZC13aXRoLXZ1bG5lcmFiaWxpdGllcy9hbXAv?oc=5#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/harchi90.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Messenger billed as better than Signal is riddled with vulnerabilities\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/harchi90.com\/#website\",\"url\":\"https:\/\/harchi90.com\/\",\"name\":\"harchi90\",\"description\":\"Just another WordPress site\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/harchi90.com\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/harchi90.com\/#\/schema\/person\/0689156e87fbe869f0e5efdeef200d5b\",\"name\":\"islamlacoste58\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/harchi90.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/5bf7491076e3822b8e0de7b1f9364d75?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/5bf7491076e3822b8e0de7b1f9364d75?s=96&d=mm&r=g\",\"caption\":\"islamlacoste58\"},\"sameAs\":[\"http:\/\/harchi90.com\"],\"url\":\"https:\/\/harchi90.com\/author\/islamlacoste58\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Messenger billed as better than Signal is riddled with vulnerabilities - harchi90","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/news.google.com\/__i\/rss\/rd\/articles\/CBMifmh0dHBzOi8vYXJzdGVjaG5pY2EuY29tL2luZm9ybWF0aW9uLXRlY2hub2xvZ3kvMjAyMy8wMS9tZXNzZW5nZXItYmlsbGVkLWFzLWJldHRlci10aGFuLXNpZ25hbC1pcy1yaWRkbGVkLXdpdGgtdnVsbmVyYWJpbGl0aWVzL9IBggFodHRwczovL2Fyc3RlY2huaWNhLmNvbS9pbmZvcm1hdGlvbi10ZWNobm9sb2d5LzIwMjMvMDEvbWVzc2VuZ2VyLWJpbGxlZC1hcy1iZXR0ZXItdGhhbi1zaWduYWwtaXMtcmlkZGxlZC13aXRoLXZ1bG5lcmFiaWxpdGllcy9hbXAv?oc=5","og_locale":"en_US","og_type":"article","og_title":"Messenger billed as better than Signal is riddled with vulnerabilities - harchi90","og_description":"Getty Images Academic researchers have discovered serious vulnerabilities in the core of Threema, an instant messenger that its Switzerland-based developer says provides a level of security and privacy \u201cno other chat service\u201d can offer. Despite the unusually strong claims and two independent security audits Threema has received, the researchers said the flaws completely undermine assurances &hellip; Messenger billed as better than Signal is riddled with vulnerabilities Read More &raquo;","og_url":"https:\/\/news.google.com\/__i\/rss\/rd\/articles\/CBMifmh0dHBzOi8vYXJzdGVjaG5pY2EuY29tL2luZm9ybWF0aW9uLXRlY2hub2xvZ3kvMjAyMy8wMS9tZXNzZW5nZXItYmlsbGVkLWFzLWJldHRlci10aGFuLXNpZ25hbC1pcy1yaWRkbGVkLXdpdGgtdnVsbmVyYWJpbGl0aWVzL9IBggFodHRwczovL2Fyc3RlY2huaWNhLmNvbS9pbmZvcm1hdGlvbi10ZWNobm9sb2d5LzIwMjMvMDEvbWVzc2VuZ2VyLWJpbGxlZC1hcy1iZXR0ZXItdGhhbi1zaWduYWwtaXMtcmlkZGxlZC13aXRoLXZ1bG5lcmFiaWxpdGllcy9hbXAv?oc=5","og_site_name":"harchi90","article_published_time":"2023-01-10T15:41:05+00:00","og_image":[{"url":"https:\/\/cdn.arstechnica.net\/wp-content\/uploads\/2023\/01\/broken-chain-760x380.jpg"}],"author":"islamlacoste58","twitter_card":"summary_large_image","twitter_image":"https:\/\/cdn.arstechnica.net\/wp-content\/uploads\/2023\/01\/broken-chain-760x380.jpg","twitter_misc":{"Written by":"islamlacoste58","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/harchi90.com\/messenger-billed-as-better-than-signal-is-riddled-with-vulnerabilities\/","url":"https:\/\/news.google.com\/__i\/rss\/rd\/articles\/CBMifmh0dHBzOi8vYXJzdGVjaG5pY2EuY29tL2luZm9ybWF0aW9uLXRlY2hub2xvZ3kvMjAyMy8wMS9tZXNzZW5nZXItYmlsbGVkLWFzLWJldHRlci10aGFuLXNpZ25hbC1pcy1yaWRkbGVkLXdpdGgtdnVsbmVyYWJpbGl0aWVzL9IBggFodHRwczovL2Fyc3RlY2huaWNhLmNvbS9pbmZvcm1hdGlvbi10ZWNobm9sb2d5LzIwMjMvMDEvbWVzc2VuZ2VyLWJpbGxlZC1hcy1iZXR0ZXItdGhhbi1zaWduYWwtaXMtcmlkZGxlZC13aXRoLXZ1bG5lcmFiaWxpdGllcy9hbXAv?oc=5","name":"Messenger billed as better than Signal is riddled with vulnerabilities - harchi90","isPartOf":{"@id":"https:\/\/harchi90.com\/#website"},"datePublished":"2023-01-10T15:41:05+00:00","dateModified":"2023-01-10T15:41:05+00:00","author":{"@id":"https:\/\/harchi90.com\/#\/schema\/person\/0689156e87fbe869f0e5efdeef200d5b"},"breadcrumb":{"@id":"https:\/\/news.google.com\/__i\/rss\/rd\/articles\/CBMifmh0dHBzOi8vYXJzdGVjaG5pY2EuY29tL2luZm9ybWF0aW9uLXRlY2hub2xvZ3kvMjAyMy8wMS9tZXNzZW5nZXItYmlsbGVkLWFzLWJldHRlci10aGFuLXNpZ25hbC1pcy1yaWRkbGVkLXdpdGgtdnVsbmVyYWJpbGl0aWVzL9IBggFodHRwczovL2Fyc3RlY2huaWNhLmNvbS9pbmZvcm1hdGlvbi10ZWNobm9sb2d5LzIwMjMvMDEvbWVzc2VuZ2VyLWJpbGxlZC1hcy1iZXR0ZXItdGhhbi1zaWduYWwtaXMtcmlkZGxlZC13aXRoLXZ1bG5lcmFiaWxpdGllcy9hbXAv?oc=5#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/news.google.com\/__i\/rss\/rd\/articles\/CBMifmh0dHBzOi8vYXJzdGVjaG5pY2EuY29tL2luZm9ybWF0aW9uLXRlY2hub2xvZ3kvMjAyMy8wMS9tZXNzZW5nZXItYmlsbGVkLWFzLWJldHRlci10aGFuLXNpZ25hbC1pcy1yaWRkbGVkLXdpdGgtdnVsbmVyYWJpbGl0aWVzL9IBggFodHRwczovL2Fyc3RlY2huaWNhLmNvbS9pbmZvcm1hdGlvbi10ZWNobm9sb2d5LzIwMjMvMDEvbWVzc2VuZ2VyLWJpbGxlZC1hcy1iZXR0ZXItdGhhbi1zaWduYWwtaXMtcmlkZGxlZC13aXRoLXZ1bG5lcmFiaWxpdGllcy9hbXAv?oc=5"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/news.google.com\/__i\/rss\/rd\/articles\/CBMifmh0dHBzOi8vYXJzdGVjaG5pY2EuY29tL2luZm9ybWF0aW9uLXRlY2hub2xvZ3kvMjAyMy8wMS9tZXNzZW5nZXItYmlsbGVkLWFzLWJldHRlci10aGFuLXNpZ25hbC1pcy1yaWRkbGVkLXdpdGgtdnVsbmVyYWJpbGl0aWVzL9IBggFodHRwczovL2Fyc3RlY2huaWNhLmNvbS9pbmZvcm1hdGlvbi10ZWNobm9sb2d5LzIwMjMvMDEvbWVzc2VuZ2VyLWJpbGxlZC1hcy1iZXR0ZXItdGhhbi1zaWduYWwtaXMtcmlkZGxlZC13aXRoLXZ1bG5lcmFiaWxpdGllcy9hbXAv?oc=5#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/harchi90.com\/"},{"@type":"ListItem","position":2,"name":"Messenger billed as better than Signal is riddled with vulnerabilities"}]},{"@type":"WebSite","@id":"https:\/\/harchi90.com\/#website","url":"https:\/\/harchi90.com\/","name":"harchi90","description":"Just another WordPress site","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/harchi90.com\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/harchi90.com\/#\/schema\/person\/0689156e87fbe869f0e5efdeef200d5b","name":"islamlacoste58","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/harchi90.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/5bf7491076e3822b8e0de7b1f9364d75?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/5bf7491076e3822b8e0de7b1f9364d75?s=96&d=mm&r=g","caption":"islamlacoste58"},"sameAs":["http:\/\/harchi90.com"],"url":"https:\/\/harchi90.com\/author\/islamlacoste58\/"}]}},"jetpack_featured_media_url":"","jetpack-related-posts":[{"id":194923,"url":"https:\/\/harchi90.com\/attention-samsung-phone-users-upgrade-galaxy-store-to-latest-version-right-now\/","url_meta":{"origin":182709,"position":0},"title":"Attention Samsung phone users, upgrade Galaxy Store to latest version right now!","date":"January 23, 2023","format":false,"excerpt":"Last updated: January 23rd, 2023 at 10:39 UTC+01:00 If you own a Galaxy smartphone, there are vulnerabilities in the Galaxy Store app that let attackers install any app on a Galaxy Phone without your knowledge. The vulnerabilities were found by researchers at NCC Group, the cybersecurity firm, between November 23\u2026","rel":"","context":"In &quot;Technology&quot;","img":{"alt_text":"galaxy-store-vulnerabilities","src":"https:\/\/i0.wp.com\/www.sammobile.com\/wp-content\/uploads\/2023\/01\/galaxy-store-vulnerabilities-720x535.jpg?resize=350%2C200&ssl=1","width":350,"height":200},"classes":[]},{"id":145304,"url":"https:\/\/harchi90.com\/hive-social-turns-off-servers-researchers-after-warn-hackers-can-access-all-data\/","url_meta":{"origin":182709,"position":1},"title":"Hive Social turns off servers researchers after warn hackers can access all data","date":"December 1, 2022","format":false,"excerpt":"Hive Social Hive Social, a social media platform that has seen meteoric growth since Elon Musk took over Twitter, abruptly shut down its service on Wednesday after a security advisory warned the site was riddled with vulnerabilities that exposed all data stored in user accounts. \u201cThe issues we reported allow\u2026","rel":"","context":"In &quot;Technology&quot;","img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":123446,"url":"https:\/\/harchi90.com\/lenovo-driver-goof-poses-security-risk-for-users-of-25-notebook-models\/","url_meta":{"origin":182709,"position":2},"title":"Lenovo driver goof poses security risk for users of 25 notebook models","date":"November 10, 2022","format":false,"excerpt":"Getty Images More than two dozen Lenovo notebook models are vulnerable to malicious hacks that disable the UEFI secure boot process and then run unsigned UEFI apps or load bootloaders that permanently backdoor a device, researchers warned on Wednesday. At the same time that researchers from security firm ESET disclosed\u2026","rel":"","context":"In &quot;Technology&quot;","img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":144536,"url":"https:\/\/harchi90.com\/chrome-defender-and-firefox-0-days-linked-to-commercial-it-firm-in-spain\/","url_meta":{"origin":182709,"position":3},"title":"Chrome, Defender, and Firefox 0-days linked to commercial IT firm in Spain","date":"December 1, 2022","format":false,"excerpt":"Google researchers said on Wednesday they have linked a Barcelona, \u200b\u200bSpain-based IT company to the sale of advanced software frameworks that exploit vulnerabilities in Chrome, Firefox, and Windows Defender. Variston IT bills itself as a provider of tailor-made Information security solutions, including technology for embedded SCADA (supervisory control and data\u2026","rel":"","context":"In &quot;Technology&quot;","img":{"alt_text":"","src":"https:\/\/i0.wp.com\/cdn.arstechnica.net\/wp-content\/uploads\/2022\/11\/heliconia-noise-cleaning-script-300x313.png?resize=350%2C200&ssl=1","width":350,"height":200},"classes":[]},{"id":122410,"url":"https:\/\/harchi90.com\/patches-for-6-zero-days-under-active-exploit-are-now-available-from-microsoft\/","url_meta":{"origin":182709,"position":4},"title":"Patches for 6 zero-days under active exploit are now available from Microsoft","date":"November 9, 2022","format":false,"excerpt":"It's the second Tuesday of the month, and that means it's Update Tuesday, the monthly release of security patches available for nearly all software Microsoft supports. This time around, the software maker has fixed six zero-days under active exploit in the wild, along with a wide range of other vulnerabilities\u2026","rel":"","context":"In &quot;Technology&quot;","img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":177179,"url":"https:\/\/harchi90.com\/hundreds-of-wordpress-sites-infected-by-recently-discovered-backdoor\/","url_meta":{"origin":182709,"position":5},"title":"Hundreds of WordPress sites infected by recently discovered backdoor","date":"January 4, 2023","format":false,"excerpt":"Malware that exploits unpatched vulnerabilities in 30 different WordPress plugins has infected hundreds if not thousands of sites and may have been in active use for years, according to a writeup published last week. The Linux-based malware installs a backdoor that causes infected sites to redirect visitors to malicious sites,\u2026","rel":"","context":"In &quot;Technology&quot;","img":{"alt_text":"","src":"https:\/\/i0.wp.com\/cdn.arstechnica.net\/wp-content\/uploads\/2023\/01\/malicious-javascript.png?resize=350%2C200&ssl=1","width":350,"height":200},"classes":[]}],"fifu_image_url":"https:\/\/cdn.arstechnica.net\/wp-content\/uploads\/2023\/01\/broken-chain-760x380.jpg","_links":{"self":[{"href":"https:\/\/harchi90.com\/wp-json\/wp\/v2\/posts\/182709"}],"collection":[{"href":"https:\/\/harchi90.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/harchi90.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/harchi90.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/harchi90.com\/wp-json\/wp\/v2\/comments?post=182709"}],"version-history":[{"count":0,"href":"https:\/\/harchi90.com\/wp-json\/wp\/v2\/posts\/182709\/revisions"}],"wp:attachment":[{"href":"https:\/\/harchi90.com\/wp-json\/wp\/v2\/media?parent=182709"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/harchi90.com\/wp-json\/wp\/v2\/categories?post=182709"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/harchi90.com\/wp-json\/wp\/v2\/tags?post=182709"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}