Signal Pours Cold Water On Zero-day Exploit Rumors

Communications leaders must stop thinking of security as someone else’s job and start treating it as a core part of their own. A previously unknown zero-click vulnerability in Apple’s iMessage appears to have been exploited by sophisticated threat actors targeting high-profile individuals across the United States and the European Union. The attack, detailed in recent research by cybersecurity firm DARKNAVY, exploits WeChat’s built-in browser components and URL parsing mechanisms to execute remote code without requiring any user interaction beyond receiving the message. Another issue with Conversation Injection is that it only persists for the current conversation. We found that, similarly to Conversation Injection, SearchGPT can actually get ChatGPT to update its memories, allowing us to create an exfiltration that will happen for every single response.

Left out of the statement is that the protocol the researchers analyzed is old because they disclosed the vulnerabilities to Threema, and Threema updated it. Those working in government should follow government guidance on the use of non-corporate communications channels. The NCSC has previously reported on the targeting of government officials’ accounts by China state-affiliated APT31, Russian Federal Security Service (FSB) actor Star Blizzard and Iran’s Islamic Revolutionary Guard Corps (IRGC).

These tools facilitate collaboration by enabling employees to share ideas, documents, and feedback seamlessly. The good news for people who use Apple phones is that https://www.threads.com/@talklivcom iMessage and FaceTime are also already end-to-end encrypted, says Hong. For Android phones, encryption is available in Google Messages if the senders and recipients all have the feature turned on.

Bad actors such as cybercriminals might have different objectives, Hong says, « but if you just do a few relatively simple things, you can actually protect yourself from the vast majority of those kinds of threats. » « Encryption is your friend » for texts and phone calls, Jeff Greene, CISA’s executive assistant director for cybersecurity, said on the briefing call. « Even if the adversary is able to intercept the data, if it is encrypted, it will make it impossible, if not really hard, for them to detect it. So our advice is to try to avoid using plain text. »

« These are for legitimate wiretaps that have been authorized by the courts, » Hong says. But in hackers’ hands, he says, the tools could potentially be used « to surveil communications and metadata for lots of people. And it seems like the hackers’ focus is primarily Washington, D.C. » She recommends getting 2FA messages through an app like Google Authenticator or Authy or by using a physical security key to verify access.

The agencies also want companies to bolster their security practices and work with the government to make their networks harder to compromise. The FBI and CISA also advise users to set their phones to update operating systems automatically. Panda Security, a WatchGuard Technologies brand, offers the most advanced protection for your family and business. In the military, sending classified data over insecure channels is called « spillage »; it can be a career ender for a military officer.

Every device that accesses sensitive communications must be kept up to date with the latest operating system patches. Antivirus software should be standard, and full-disk encryption should be mandatory. Passwords must be strong and unique, and biometric authentication should be enabled wherever possible. Imagine a PR team coordinating a response to a major reputational crisis, using Signal to keep their discussions private.

When users update their contact profiles, including nickname, photo, or wallpaper, the system generates “Nickname Updates” that are processed by recipients’ devices. WeChat’s mini-programs, used by over 1.2 billion users, operate in a dual-thread architecture. JavaScript logic and rendering layers are isolated, preventing cross-layer privilege escalation.

It’s among the top Android apps for a fee-based category in Switzerland, Germany, Austria, Canada, and Australia. The app uses a custom-designed encryption protocol in contravention of established cryptographic norms. The extensive monthly patch is a reminder of the persistent security challenges facing major enterprise software platforms. In recent months, Microsoft has also contended with significant vulnerabilities in its SharePoint servers, some of which were reported to be actively exploited. Web message vulnerabilities arise when a script sends attacker-controllable data as a web message to another document within the browser.

• This collaboration aims to improve security measures and ensure rapid responses to any identified vulnerabilities, safeguarding users against emerging cyber threats.
• Communications leaders must stop thinking of security as someone else’s job and start treating it as a core part of their own.
• JSBridge interfaces, which enable web-to-native functions like scanQRCode, are tightly controlled via cloud-based permission arrays, limiting access for untrusted sites.
• At the time when Threema first released, the space of messaging protocols was still pretty empty, but OTR (from 2004) did already achieve forward secrecy.
• Safely scan your entire online portfolio for vulnerabilities with a high degree of accuracy without heavy manual effort or disruption to critical web applications.

Fbi Warns Americans To Keep Their Text Messages Secure: What To Know

Many less popular applications have not been researched, and it is currently unknown if this security fault could be observed there. She plans to continue investigating similar issues that could reveal more problems. What makes this attack particularly dangerous is its exploitation of WeChat’s debugging URL mechanism and built-in browser features. The app includes debugging functionality triggered when users access URLs containing specific parameters, which attackers can abuse to execute high-risk actions like configuration changes without user awareness.

The flaw, which was caught by internal researchers on the WhatsApp security team, was used in a very targeted attack that hit less than 200 users, according to WhatsApp. High-risk individuals face a greater likelihood of attacks against their accounts due to a combination of their role and potential access to sensitive information and important people. You might be a high-risk individual if your work or public status means you have access to, or influence over, sensitive information that could be of interest to threat actors. An attacker could exploit this flaw to overwrite critical data or execute malicious code within the context of the Teams application. Signal is still one of the most secure messaging apps available, but it’s not foolproof. And as recent incidents have shown, even the best tools can be compromised if used carelessly.

The Meta-owned company said the issue « could have allowed an unrelated user to trigger processing of content from an arbitrary URL on a target’s device. » Academic researchers have discovered serious vulnerabilities in the core of Threema, an instant messenger that its Switzerland-based developer says provides a level of security and privacy “no other chat service” can offer. The “generate link preview” feature is known to have privacy and security risks and has led to critical-severity vulnerability problems on Meta’s WhatsApp platform. Google Project Zero found a vulnerability in top messaging apps that allowed hackers to listen and watch through their victims’ phones without them knowing. By taking these precautions seriously, users can transform their everyday messaging into truly secure communications.

This trust was rattled when a Signal notification involving a journalist cast doubts over its security. But experts clarify that the issue stems from user mistakes, not a breach within Signal itself. Forensic examination of affected devices revealed suspicious activity consistent with known spyware cleanup procedures. The NICKNAME vulnerability exploits a race condition in the “imagent” process, which handles all iMessage traffic on iOS devices.

The original source for the zero-day warning is unknown but Signal said it checked with its contacts across the US Government, since the copy-paste report claimed USG as a source. “Those we spoke to have no info suggesting this is a valid claim,” the company said on X, the social media site previously known as Twitter. In marketing, product launch plans, advertising budgets, and influencer contracts often contain sensitive financial and strategic information.

For instance, when email accounts are compromised, sensitive information can be leaked, leading to significant financial losses and reputation damage. Similarly, vulnerabilities in messaging apps can allow unauthorized access to confidential conversations, risking the exposure of trade secrets. In the realm of video conferencing, lapses in security can permit uninvited guests to join meetings, potentially disrupting discussions and leaking sensitive content.

The Apple vulnerability is a bug in Image/IO, which allows applications to read and write most image file formats, that could result in memory corruption if a user processes a malicious image. In a statement shared with The Hacker News, WhatsApp said it sent in-app threat notifications to less than 200 users who may have been targeted as part of the campaign. « Early indications are that the WhatsApp attack is impacting both iPhone and Android users, civil society individuals among them, » Ó Cearbhaill said. « Government spyware continues to pose a threat to journalists and human rights defenders. »

Legacy Systems, Real-world Impacts: The Reality Of Ot Security

Ó Cearbhaill described the pair of vulnerabilities as a « zero-click » attack, meaning it does not require any user interaction, such as clicking a link, to compromise their device. Following the discovery of the FaceTime vulnerability, Project Zero found similar flaws affecting Signal, Google Duo, Facebook Messenger, JioChat, and Mocha. No issues were found in the Telegram or Viber apps after they were also investigated. The findings come after Threema received wide acclaim for its supposedly robust E2EE and has undergone at least two security audits.

It is also possible to have a memory about the type of response you want, which will be taken into account whenever ChatGPT responds. WhatsApp has patched a security flaw used in “zero-click” spyware attacks requiring no interaction from the user. The security flaws, which required little technical skill to exploit, have all since been patched. Threema has introduced mitigations after the researchers privately shared their findings. The updates include a new custom protocol named Ibex, which fixes vulnerabilities 2.1 and 2.2. Threema developers also removed compression altogether, a change that fixes vulnerability 3.2.

Cve Cisa Kev Update By Cybersecurity And Infrastructure Security Agency (cisa) Us Civilian Government

In this post, we’ll explore the major data breaches that affected messaging apps between 2020 and 2024, analyze what went wrong, and extract lessons to build safer communication platforms — without sacrificing convenience. Sometimes ChatGPT will respond with the output of SearchGPT’s browsing results as-is, and sometimes it will take the full output and modify its reply based on the question. As a method of isolation, SearchGPT has no access to the user’s memories or context. Therefore, despite being susceptible to prompt injection in the Browsing Context, the user should, theoretically, be safe, as SearchGPT is doing the browsing. The situation is becoming increasingly alarming as cybercriminals develop more advanced attack methods. Recent data indicates a staggering 150% increase in attack attempts targeting users of these messaging applications over the last quarter alone.

The affected devices belonged to political campaign staff, journalists, tech executives, and government officials in the EU and the US. WeChat’s Android client uses the XWEB engine, a Chromium-based browser lagging behind official releases (v130 vs. Chrome’s v136). Despite this, XWEB employs sandboxing, isolating rendering processes (xweb_sandboxed_process_0) from privileged ones to mitigate exploits. JSBridge interfaces, which enable web-to-native functions like scanQRCode, are tightly controlled via cloud-based permission arrays, limiting access for untrusted sites.