This flawed line of code is part of the function used to check an attachment's MAC, information used to confirm that it hasn't been changed in transit. Despite this additional data, the value of remainingData will still equal that of the original attachment, as remainingData cannot store all of the data returned by file.length() minus mac.getMacLength(). As Java is a type-safe language, this doesn't cause a memory corruption condition, but the researchers found that the overflow could be used to subvert the program logic by adding random data equal to 4 GB + 1 byte to an encrypted attachment. However, "file.length()" returns a 64-bit signed integer, and it may be a lot longer than remainingData can handle. The "remainingData" variable is a 32-bit signed integer, calculated from the length of the file minus the length of its message authentication code (MAC). Int remainingData = (int) file.length() - mac.getMacLength() The error occurs in the following line of code: While reviewing the Java code used in the Android version of the Signal app, they found a classic coding error - an overflow bug. The whole project is open source, so anyone can see how the encryption and the other security mechanisms have been implemented, which is exactly what researchers Jean-Philippe Aumasson and Markus Vervier decided to do. The Signal app code is also used by the WhatsApp messaging app. All of the messages sent between devices running the app are encrypted end-to-end, and it has been downloaded well over a million times. For an app that prides itself on privacy, word-of-mouth advertising doesn’t get much better than nabbing an endorsement from whistleblower and privacy advocate Edward Snowden.Signal is a private messaging app made by Open Whisper Systems for iPhone and Android devices. Signal has also received glowing reviews. Signal is free to download and easy to use, and can be used on mobile devices and desktops, including Linux. The app isn’t tied to any large tech companies, whereas WhatsApp was bought up by Facebook in 2014. One of the key differences between Signal and WhatsApp is that Signal is an independent non-profit.
On Signal, you can even create group chats with up to 1,000 participants.
Signal is just like WhatsApp in that you can make voice calls, video calls, send messages, pictures, and stickers. Privacy is central to Signal’s offering, promising end-to-end encryption and “no creepy tracking”. Amid the outage news, Facebook whistleblower Frances Haugen told a senate subcommittee that “left alone, Facebook will continue to make choices that go against the common good – our common good.”
0 kommentar(er)
