This post has been rewritten throughout to make clear that the MAC-bypass vulnerability allows attackers to append pseudorandom data to encrypted attachments. It doesn't allow attackers to choose the underlying plaintext of the tampered attachment or to replace one attachment with another. The revision also makes clear that the compression is effective only while the modified attachment is in transit, and must be decompressed to a size of more than 4 gigabytes once received by the other party. Last, the revisions remove analysis about nation-sponsored attackers, because they aren't likely to exploit this kind of bug. The reporter initially misunderstood the research and didn't confirm it with Signal developers before publishing. The reporter regrets the error.

Signal, the mobile messaging app recommended by NSA leaker Edward Snowden and a large number of security professionals, just fixed a bug that allowed attackers to add random data to the attachments of encrypted messages sent by Android users. The update is available on this Github submission, but isn't yet available in the Google Play market for Android apps.

The message authentication-bypass vulnerability was one of two weaknesses found by researchers Jean-Philippe Aumasson and Markus Vervier in an informal review of the Java code used by the Android version of Signal. The bug made it possible for attackers who compromised or impersonated a Signal server to modify a valid attachment by adding random data to it. A second bug possibly would have allowed attackers to remotely execute malicious code, but Vervier told Ars that a third bug limited exploits to a simple remote crash.

"The results are not catastrophic, but show that, like any piece of software, Signal is not perfect," Aumasson wrote in an e-mail. "Signal drew the attention of many security researchers, and it's impressive that no vulnerability was ever published until today. This pleads in favor of Signal, and we'll keep trusting it."

The attachment-corrupting vulnerability was the result of an integer overflow bug that was triggered when extremely large files, at least 4 gigabytes in size, were attached to a message. Instead of verifying the authenticity of the entire file, Signal would check only a small portion, making it possible for attackers to append pseudorandom data that wouldn't be detected by the MAC (message authentication code) that's a standard part of most encryption schemes. To make such attacks more practical, an adversary could use file compression that's supported by Signal to reduce the size of the malicious attachment to a manageable 4 megabytes while in transit.

In his e-mail, Aumasson said the overflow bug was found in the following line of code:

int remainingData = (int) file.length() - mac.getMacLength();

He explained:

Here, the value "file.length()" is a number encoded on 64 bits (of type "long"), whereas the receiving variable "remainingData" is a number encoded on 32 bits (of type "int"). Therefore, when "file.length()" is longer than what fits in a 32-bit number, the value of "remainingData" (the number of bytes left to process) will be incorrect, as it will be much smaller than the real size of the file. Consequently, a large part of the file will be ignored when Signal will verify the cryptographic authenticity. Signal will only check the (small) beginning of the file, whereas the user will actually receive the much larger file.

One of the reasons for Signal's appeal is that it deploys end-to-end encryption, meaning it encrypts a message on the sender's device and doesn't decrypt it until it is safely stored on the receiving device. Still, the encrypted message passes through a server. The message authentication bypass exploit could be carried out by hacking or impersonating such a server and then tampering with message attachments. To circumvent transport-layer security protections, an impersonating attacker might compromise any one of the hundreds of certificate authorities trusted by the Android operating system or trick targets into installing a rogue CA certificate on their devices. Additional details about the vulnerabilities are here

The researchers privately reported the vulnerabilities to Signal developer Open Whisper Systems on September 13 and the company has already issued an update. Aumasson and Vervier—who are the principal research engineer at Kudelski Security and CEO and head of security research at X41 respectively—said they're still working to determine if the same bugs affect WhatsApp, the Facebook messaging app that also relies on Signal code.

In an e-mail, Open Whisper System founder Moxie Marlinspike wrote: