Table 4 enumerates the data types that we searched for during our analysis of Android apps. Google defines and uses these data types to populate the information presented to users in the form of privacy labels in the app’s listing on Google Play Store (Google, 2023d). The contents of a push notification and its metadata may be disclosed to unauthorized entities. In recent months, there has also been an increase in attempts to hijack WhatsApp accounts using social engineering.
That’s a serious liability for any organization handling confidential information, be it corporate strategy, crisis communications, or sensitive negotiations. High-security messaging apps like Signal can be compromised, either by human error or cyberattacks. What does this mean for organizations managing sensitive data, and what should leaders in communications and security be doing right now to reduce exposure? It’s a call for a more disciplined, better-informed approach to communications security, one that acknowledges the real-world tactics of threat actors and the operational blind spots that too many organizations still ignore. Of the 20 apps we analyzed, 11 included personal information in data sent to Google via FCM such that that data was visible to Google.
Appendix B Code Analysis Workflow
These links trick users into adding attacker-controlled devices to their Signal accounts. Once added, the attacker gains real-time access to all future messages in that conversation. The encryption itself remains intact, but the attacker is now a legitimate participant in the chat.
Top 10 Malware Threats Of The Week – Asyncrat, Remcos, And Xworm Lead The Surge
This memory corruption can trigger a Use-After-Free (UAF) vulnerability, causing the imagent process to crash. However, sophisticated attackers could potentially leverage this corruption as a primitive for achieving code execution on targeted devices. The discovery, made by cybersecurity firm iVerify, reveals how attackers could compromise iPhones without any user interaction by exploiting a flaw in iMessage’s contact profile update feature. These trends turned messaging apps into critical digital infrastructure, making their protection as vital as corporate networks. Between 2020 and 2024, messaging apps evolved from casual chat tools into essential communication infrastructure.
It also underscores the ongoing challenge of balancing the need for secure communication with the convenience and accessibility offered by popular messaging apps. Of the popular secure messaging apps that we identified, 20 of 21 apps relied on FCM to deliver push notifications to users. One exception among those apps was Briar messenger, which prompted the user to enable unrestricted battery usage, allowing the app to poll for new messages in the background. (Several other apps in our dataset also prompted us to enable unrestricted battery usage, however, those apps still relied on FCM.) Since our study focuses on FCM, we excluded Briar and analyzed only those applications that relied on FCM to deliver push notifications. Our work involves reverse-engineering the client apps of popular Android secure instant messengers in order to glean the types of information being leaked to Google’s FCM servers in push notifications. We performed our analysis by running each app on our test devices, with test accounts, on a segmented and private network, and observing both the network traffic that resulted and, when that network traffic did not reveal personal information, the static code.
- Individuals may become identified based on the information linked to their device’s push tokens.
- The vulnerability in question is an out-of-bounds write vulnerability in the ImageIO framework that could result in memory corruption when processing a malicious image.
- Although app developers could, in theory, implement their own push notification service, this is usually impractical as it requires the app to continually run as a background service, thereby reducing battery life.
- Those attacks have taken on increasing significance as targeted mobile surveillance explodes around the world.
The first is to treat phone numbers and codes received via SMS as sensitive credentials that should never be shared , even if https://f6s.com/ the person requesting them appears to be a friend, a technician, or the app itself. Signal’s response underscored the distinction between vulnerabilities in an app’s security infrastructure and external threats like phishing. They argued that conflating these distinct issues misrepresents the security of the app and unfairly casts doubt on its encryption protocols.
Because push notification SDKs are generally provided by third parties (as opposed to app developers), incorrect usage may leak sensitive information to those third parties. For example, an app that provides “end-to-end” encrypted messaging may not actually provide end-to-end encryption if message payloads are not encrypted before being sent to third-party push notification APIs. To make matters worse, misuse of these SDKs may also contribute to the misrepresentation of security and privacy assurances to consumers as articulated in various disclosures, including privacy policies, terms of service, and marketing materials. Prior research has demonstrated how attackers can exploit mobile push notifications to spam users with advertisements (Liu et al., 2019), launch phishing attacks (Xu and Zhu, 2012), and even issue commands to botnets (Ahmadi et al., 2016; Lee et al., 2014; Hyun et al., 2018). Other studies have revealed additional security issues with PNSs that can result in the loss of confidentiality (i.e., user messages get exposed to unauthorized parties) and integrity (i.e., users receive malicious messages from unauthorized parties) (Chen et al., 2015).
Smishing (sms Phishing)
Most notably, researchers observed these crashes on at least one device belonging to a senior European Union government official approximately thirty days before they received an Apple Threat Notification. True digital safety requires not just encryption, but also user awareness, platform transparency, and adaptive regulation. This chain of events effectively enables remote code execution (RCE) or content spoofing, which could be leveraged to drop payloads ranging from credential-stealing scripts to ransomware.
The debate over the security of Signal and the appropriateness of its use for government communications is likely to continue. However, Signal’s firm denial of any inherent vulnerabilities within its platform and its clarification regarding the nature of the phishing threats underlines the importance of distinguishing between technical flaws and user-related security risks. This incident serves as a reminder of the ever-present threat of phishing attacks and the need for constant vigilance in protecting personal and sensitive information online, regardless of the platform used.
Scotland bans WhatsApp for official use, leading a movement towards secure, transparent government communication with platforms like Wire. „I think it’s really incumbent on software developers and these companies to have much better privacy and security by default,” Hong says. „That way you don’t need a Ph.D. to really understand all the options and to be secure.” As agencies work to oust the hackers, the FBI called for Americans to embrace tight encryption — an about-face, Galperin says, after years of insisting that law enforcement agencies need a „back door” to access communications.
Our device supported security updates and the installation of all the apps that we analyzed for this research. We ran these apps and received push notifications from FCM without observing any undesirable impact on app performance. Furthermore, at the time we began our analysis in early 2023, the majority of users (more than 85%) used Android version 12 or below (StatCounter Global Stats, 2023). While most people who use a mobile phone use an Android device, iOS also has a significant share of the mobile phone market and tends to bill itself as having more privacy-preserving practices.
WeChat’s file processing system, designed to enhance user experience through file previews and content extraction, creates significant security exposure when handling untrusted content. WeChat’s layered defenses, from URL validation to sandboxed browsers, demonstrate a proactive approach to security. WeChat’s debugging mechanism, accessible via URLs like debugxweb.qq.com, poses risks if exploited. Attackers could manipulate parameters to force version rollbacks or configuration changes. Apple addressed the vulnerability in iOS 18.3 by implementing a more secure approach to handling Nickname Updates. The fix involves using immutable copies of dictionaries when broadcasting nickname updates, effectively preventing the race condition that enabled exploitation.
In most cases, the vulnerabilities enabled unauthorized personnel to listen in on a call recipient without requiring any interaction from said recipient. The Signal bug, patched in September 2019, allowed an individual to listen in on the recipient’s surroundings, for example, while a Google Duo flaw caused the leak of video packets from unanswered calls. The vulnerability in question is an out-of-bounds write vulnerability in the ImageIO framework that could result in memory corruption when processing a malicious image. This recommendation underscores the severity of the vulnerabilities and the potential impact on organizational security posture.
Another area where messaging apps have become a hunting ground for criminals is identity theft and phishing . Campaigns that were previously limited to email are now also distributed via SMS, WhatsApp, and other channels, with messages that pretend to be legitimate notifications to trick users into clicking where they shouldn’t. Google’s Project Zero discovered that a security flaw might have allowed hackers to eavesdrop on Android users.
Out of the remaining 8 apps, only 4 mentioned Google in the context of push notifications and/or FCM. Heightened public concerns around the monitoring of online communications have significantly influenced consumer behavior in the past decade. A 2014 PEW survey found that 70% of Americans are concerned about government surveillance and 80% about surveillance by corporations (Madden, 2014). In response to these concerns, more and more consumers have begun using secure messaging apps to protect their communications based on the promises of privacy made by these apps.