Post #3145170
2025-01-21 22:33 UTC
Technical details tl;dr:
- Signal (and other communication platforms) uses Cloudflare with caching enabled for media
- one can check on which Cloudflare endpoints a given attachment URL got cached (one can use a VPN for this), giving them the ability to roughly geolocate users whose Signal downloaded the file
- a doctored version of Signal (or whatever app) allows the attacker to send the message with an image, and extract the attachment URL to know what URL to check for having been cached
Replies (3)
-
@rysiek@mstdn.social 2025-01-21 22:40
- images usually get downloaded automatically (and thus get cached on Cloudflare side) - push notifications make this a 0-click thing, as the targeted user doesn't even have to click on a conversation to have the image downloaded I believe this technique would work against any communication app that uses any global CDN that does endpoint caching and provides the caching status in HTTP headers of the response.
-
@Gaelan@cathode.church 2025-01-21 22:42
@rysiek@mstdn.social oh yikes you're right that it's pretty niche threat model where this matters, but wow that's a devious side channel
-
@stefan@graz.social 2025-01-21 23:47
@rysiek@mstdn.social but why are these cloudflare cache headers even there?