Signal is considered by many to be the most secure messaging application on the planet, it being recommended even by the famous Edward Snowden for those who want to communicate safely with anyone who wants to talk. Unfortunately, the Signal application is not quite as secure as many think, and this is because an XSS vulnerability has been discovered, and it allows the exploitation of the web versions of the Signal application by anyone, at any time.
Signal has such a big security problem that any hacker can exploit it without the victim interacting with the malicious link sent to him and without being able to block the hacker's attack in any way. All desktop versions of Signal are affected by this very serious security issue, but those using the mobile apps for iPhone and Android should be 100% protected against such an attack, since the platforms are different.
Signal: MAJOR Application Security Problem
Video of the new attack on Signal. I know it's not the same, but in a desktop I would stick to PGP+email https://t.co/MkabYbgGW8 pic.twitter.com/DJRNBhBnTT
— Alfredo Ortega (@ortegaalfredo) May 16, 2018
Signal cannot have very important information stolen with this vulnerability, but the attacker can learn information about the identity of the victim, which is a major problem for those who use the application to be anonymous. The interesting part is that the problem was solved in the official versions of Signal by the company, it being known since April, but it was solved only now, only 3 hours after the public disclosure of the vulnerability.
"An XSS flaw is a nuisance in any application but in Signal, used by parties that want the highest levels of privacy, this is amplified. An attacker posing as a contact could use the flaw to send a message containing a malicious URL to set up a range of code-injection compromises using image, audio or iFrame tags, or simply to make the software crash.”
Signal has released updates for all official apps, but of course you need to install them to be protected against this very dangerous vulnerability, so if you use the platform, look for available updates. Despite problems of this kind, Signal still remains the favorite platform of those who want 100% secure conversations, and this is because security issues are resolved extremely quickly so that users have the highest level of security.
