Hunting For Vulnerabilities in Signal

At Blackhat 2016 Jean-Philippe Aumasson and Markus Vervier were a bit bored and decided to take a peek at the Signal source code. This actually evolved into a longer hunt for bugs in the high profile messenger recommended by Snowden. Since two of the bugs for the Java reference implementation of Signal have been publicly fixed after our disclosure, we think we should give a little description about what we found.

We checked common pitfalls of Java, Objective-C and C/C++ code and common attack vectors, by reviewing the Signal code base (Signal protocol libraries, mobile clients, service). We also reviewed the general architecture of Signal and its attack surface. We found several issues of varying impact, about which we will blog in the coming months, starting with this post.