We installed each app on two devices and triggered push notifications by sending messages from one device to another. On the recipient’s Pixel 3a device, we recorded the push notification contents as they were received by the app using the instrumented methods. Our primary research question concerns how secure messaging apps’ usage of FCM impacts user privacy. To answer this question, we identified a set of apps from the Google Play Store and compared the claims made in their privacy disclosure documents with our static and dynamic analysis of those same apps. Additionally, Google’s Play Store requires developers to provide privacy labels (Google, 2023d).

New Research Reveals Multiple Attack Surfaces In Wechat & Other Instant Messaging Apps

Your efforts will help us improve the HTML versions for all readers, because disability should not be a barrier to accessing research. Follow the Cybersecurity and Infrastructure Security Agency’s Binding Operational Directive (BOD) requirements for cloud service security, including multi-factor authentication and robust logging of all synchronization events. This chain of events effectively enables remote code execution (RCE) or content spoofing, which could be leveraged to drop payloads ranging from credential-stealing scripts to ransomware. The Pentagon-wide advisory—which cautioned employees not to use the app for work discussions, even if unclassified—stated that a “vulnerability has been identified in the Signal Messenger Application.” However, continued vigilance and adoption of cryptographic best practices remain essential as attackers evolve their methods. “I’m proud of our researchers—it’s proof of the power of collaboration,” Gurfinkel says.

— Telegram And Facebook Messenger Leaks

• Scotland bans WhatsApp for official use, leading a movement towards secure, transparent government communication with platforms like Wire.
• “That way you don’t need a Ph.D. to really understand all the options and to be secure.”
• We ran these apps and received push notifications from FCM without observing any undesirable impact on app performance.

That includes draft statements, internal assessments, and real-time strategy adjustments. The fallout could be disastrous, not just in terms of the breach itself, but in how it undermines trust with clients, stakeholders, and the public. Organizations utilizing Spring Boot frameworks, particularly those operating secure messaging environments, must immediately verify whether their /heapdump endpoints are exposed to the internet. This systematic approach to identifying vulnerable systems suggests organized cybercriminal campaigns rather than opportunistic attacks.

This guidance departs from Google’s own data minimization and secure-by-default principles (Google, 2023b) and recommendations from other push notification providers, such as Apple (Apple Inc., 2023). One such notable case is that of Zoom, in which the company faced a regulatory enforcement action for erroneously claiming to offer end-to-end encryption in its marketing materials, a feature it did not fully provide at the time (Federal Trade Commision (2020), FTC). This incident underscores the seriousness with which authorities treat misrepresentations in the digital privacy domain, highlighting the risks companies face when they do not accurately describe their data protection measures. Rather than needing to issue a patch in the mobile app, Facebook was able to adjust its own server-side infrastructure to instantly fix the flaw for all users.

Cybersecurity News

Is a cloud-based OSPNS that forwards push messages to the appropriate user device using the stored registration token(3), even if the client app is offline or in the background. It also exposes an API to the developer to enable push messaging in their applications. Alongside international partners, the NCSC has issued actions for individuals at risk of targeted attacks against messaging apps. Silvanovich adds that similar bugs likely remain undiscovered in mainstream communication apps.

Individuals may become identified based on the information linked to their device’s push tokens. When a user links their WhatsApp client on a new device, synchronization messages propagate chat histories and media over multiple endpoints. Questions about the security of Signal, which is widely regarded as the gold standard for encrypted communications, have also been raised after a Pentagon briefing titled “Signal Vulnerability” was shared by NPR just days later. This flaw affects the platform’s JSP (JavaServer Pages) application architecture, where heap content becomes accessible in a manner equivalent to traditional core dumps. CISA has issued an urgent warning regarding two critical vulnerabilities in TeleMessage TM SGNL that threat actors are currently exploiting in active attack campaigns. From there, the hacker would start hearing audio from the victim’s end of the call, even if they didn’t answer, for however long it rang.

But the sheer number of discoveries in mainstream services underscores how common these flaws can be and the need for developers to take them seriously. We analyzed privacy disclosures for the 11 apps that included personal information in the push notifications sent via Google’s FCM. We tried to determine whether the push notifications contain sensitive content by observing the strings defined in code and used in the names of the keys or in print statements. We then traced the message and any variables assigned to the sensitive content until we reached the code for displaying the notification to the user. Appendix B includes the questions we used to analyze the source code of apps in our data set. Signal is still one of the most secure messaging apps available, but it’s not foolproof.

And the company was able to determine with some certainty that the bug had never been exploited, because no logs contained evidence of the strategic protocol messages attackers would need to send. While Signal encrypts message content, it still transmits metadata such as who is talking to whom and when. For government agencies and businesses handling classified or proprietary information, this can be a significant security risk. Cases have been highlighted where foreign intelligence agencies exploited metadata to map communication networks and infer sensitive relationships between individuals, even if the actual messages remained unreadable. The recent headlines about vulnerabilities in Signal, a messaging app long touted for its end-to-end encryption and privacy-first design, have sent ripples through the cybersecurity and communications worlds. For professionals in communications, marketing, and PR who rely on secure channels to manage sensitive conversations, these revelations are more than just technical footnotes.

Unlike the FaceTime bug, which a regular user could have exploited, an attacker here would have needed technical reverse-engineering tools to send the special second message. The caller and recipient would also need to be Facebook “friends” for the attack to work, which limits its utility versus being able to call anyone out of the blue. Still, given that Facebook now has more than 2.7 billion active users, it’s possible to find a population of targets that meet almost any parameters. The NSA, in its guidance, has advised government personnel to avoid using Signal for classified or sensitive conversations.

However, Signal countered this assertion, explaining that phishing attacks, the actual threat highlighted in the advisory, are not unique to their platform and represent a persistent risk for any popular app or website. They emphasized that these attacks do not exploit flaws in Signal’s underlying encryption technology but instead rely on deceiving users into revealing their thecupidfeel.com credentials or other sensitive information. The final phase of our analysis involved comparing the claims that app developers made in their privacy disclosures to the ground truth that we observed from our dynamic and static analysis.

This incident serves as a reminder of the ever-present threat of phishing attacks and the need for constant vigilance in protecting personal and sensitive information online, regardless of the platform used. It also underscores the ongoing challenge of balancing the need for secure communication with the convenience and accessibility offered by popular messaging apps. Prior research has demonstrated how attackers can exploit mobile push notifications to spam users with advertisements (Liu et al., 2019), launch phishing attacks (Xu and Zhu, 2012), and even issue commands to botnets (Ahmadi et al., 2016; Lee et al., 2014; Hyun et al., 2018). Other studies have revealed additional security issues with PNSs that can result in the loss of confidentiality (i.e., user messages get exposed to unauthorized parties) and integrity (i.e., users receive malicious messages from unauthorized parties) (Chen et al., 2015). We additionally read each privacy policy to understand whether developers disclosed the sharing of personal information for the purposes of providing push notifications. We found that all 11 apps that shared personal information with Google’s FCM servers stated that personal user data may be shared with service providers (such as FCM) for the purpose of app functionality.

Wire joins the Apple Indigo initiative as a strategic partner, advancing secure, resilient communication for defense, government, and high-assurance… Discover why strong encryption matters in the digital age, and how Wire safeguards secure communication across industries amid global backdoor… With the rise of remote work,these platforms keep teams connected and productive, regardless of physical distance. These tools facilitate collaboration by enabling employees to share ideas, documents, and feedback seamlessly. How high-risk individuals can protect their accounts when using apps such as WhatsApp and Signal.