0-Click Deanonymization Attack Exploits Telegram, Signal, Discord And Other Apps

0-Click Deanonymization Attack Exploits Telegram, Signal, Discord, & Other AppsA new zero-click deanonymization attack has been discovered that can potentially reveal a target’s location within a 250-mile radius, posing significant privacy risks for users of popular messaging apps like Signal, Discord, and Twitter/X.

According to the researcher, his sophisticated attack exploits vulnerabilities in push notification systems and content delivery networks (CDNs) to pinpoint a user’s location without any interaction from the target.

The attack works by leveraging the caching mechanisms of CDNs like Cloudflare, which are used by many messaging apps to improve performance.

When a push notification is sent to a target device, it automatically downloads content from the app’s CDN, triggering a cache response in a nearby data center.

Investigate Real-World Malicious Links & Phishing Attacks With Threat Intelligence Lookup - Try for Free

0-Click Deanonymization Attack

By analyzing which data centers have cached specific content, an attacker can narrow down the target’s geographical location. For Signal users, the attack takes advantage of the app’s default push notification settings.

Even if a user doesn’t open a conversation, receiving a message with an attachment causes the device to download and cache the image, potentially revealing its location. This poses a particular risk for journalists, activists, and whistleblowers who rely on Signal for secure communication.

Discord is similarly vulnerable, with its Nitro subscription feature allowing attackers to use custom emojis as a vector for the attack. By sending a friend request with a specially crafted avatar, an attacker can trigger a push notification that downloads and caches the avatar image, revealing the target’s approximate location.

The researcher who discovered this attack created a tool called “GeoGuesser” to demonstrate its effectiveness.

In one test, the tool was able to locate Discord’s CTO within a 300-mile radius in less than a minute, highlighting the potential for tracking and monitoring high-profile individuals. Alarmingly, both Signal and Discord initially downplayed the severity of the vulnerability.

Signal claimed it was not their responsibility to provide network-layer anonymity, while Discord eventually attributed the issue to Cloudflare.

For its part, Cloudflare patched a specific bug related to data center traversal but maintains that it’s up to their customers to disable caching for sensitive resources.

The attack’s creator argues that these responses are inadequate, as the core vulnerability stems from the fundamental design of caching and push notification systems.

Even after Cloudflare’s patch, the researcher was able to replicate the attack using VPN services to access different data centers worldwide.

This deanonymization technique raises serious concerns about user privacy and the potential for surveillance. It demonstrates how infrastructure designed to enhance app performance can be exploited for invasive tracking.

The attack is particularly concerning because it requires no user interaction and leaves little to no trace, making it nearly undetectable.

To protect themselves, users should be cautious about enabling push notifications and consider using VPNs or other anonymizing tools.

However, the responsibility ultimately lies with app developers and infrastructure providers to implement more robust privacy protections.

As this vulnerability affects multiple popular platforms, it serves as a wake-up call for the tech industry to reevaluate how performance optimizations might compromise user privacy.

Until more comprehensive solutions are developed, users of messaging apps – especially those in sensitive positions – should remain vigilant about their digital footprint and the potential for unintended location disclosure.

Integrating Application Security into Your CI/CD Workflows Using Jenkins & Jira -> Free Webinar

The post 0-Click Deanonymization Attack Exploits Telegram, Signal, Discord And Other Apps appeared first on Cyber Security News.