Resources

People often ask me "How did you learn how to hack?" The answer: by reading. This page is a collection of the blog posts and other articles that I have accumulated over the years of my journey. Enjoy!

Threema is a Swiss encrypted messaging application used by the Swiss army and many others. It's an alternative to Signal. This article explains seven bugs they found in the code that led to a security compromise. They also discussed this on a podcast with some more context.

The first bug was due to the use of ephemeral keys in the client-to-server protocol. Once a single session key was compromised, you could continue acting as the user forever using that key. This violates the principle that these keys are temporary. It's effectively a replay attack.

The second bug was an isolation issue between two subprotocols. The Threema C2S protocol uses a special value called a vouch box in order to authenticate the user to the server. This is done by encrypting the user's ephemeral key with its long-term key. By using Threema's end-to-end (E2E) to create the key, you can trick a user into creating a valid vouch box that is sent to the attacker. They found another similar issue as well.

The timestamp on a message is NOT integrity-protected. Thus, a malicious server can reorder or even delete messages sent to it. The way Threema prevents replays on the phone is by simply remembering all the nonces you have ever seen. This becomes a problem when you reinstall the application on another phone; the nonces would also need to be transferred over.

Threema provides a cloud-based backup system for Threema Safe. The data is compressed and then encrypted using the derived key. This backup contains the long-term private key and other important information. Based on the CRIME attacks on TLS, this is vulnerable to an attacker who can partially control the data being protected. By making the username with specific data, it's possible to change the length of the compressed backup. Based on this side channel, you can recover the private key from the backup in a few hours.

The disclosure process went very bad. Although I think they have a bug bounty program, they decided none of these were eligible for a reward. Additionally, they were untruthful about the impact of the vulnerabilities in public statements.

The cryptographic assessment of the protocol was very creative. It came from various threat models and found crazy ways to perform bad actions. Overall, a great paper on the evaluation of a cryptographic protocol!