3 months ago, I discovered a unique 0-click deanonymization attack that allows an attacker to grab the location of any target within a 250 mile radius. With a vulnerable app installed on a target's phone (or as a background application on their laptop), an attacker can send a malicious payload and deanonymize you within seconds--and you wouldn't even know.
I'm publishing this writeup and research as a warning, especially for journalists, activists, and hackers, about this type of undetectable attack. Hundreds of applications are vulnerable, including some of the most popular apps in the world: Signal, Discord, Twitter/X, and others. Here's how it works:
9 Comments
dotdi@lemmy.world · 21 pts · 1y
The actual story here is that this was done and written up by a 15-year old high school student. As such, I have to say: bravo, well done!
The claim to „deanonimization“ is stretching it quite far. At best, you could prove a known person (which you know how to contact) was indeed physically in a certain location. This can be useful, but it’s hardly deanon in the traditional sense.
CameronDev@programming.dev · 7 pts · 1y
Doesn't even guarantee physical location, only the location of their VPN endpoint.
dotdi@lemmy.world · 0 pts · 1y
CameronDev@programming.dev · 1 pts · 1y
Do any of the good VPN providers leak DNS? Most VPNs claim to allow evading geolocation, if they leaked DNS that wouldnt be true?
sunzu2@thebrainbin.org · -1 pts · 1y
sun_is_ra@sh.itjust.works · 1 pts · 1y
it may not be a big deal for an average person but for a journalist or a political figure, it can cause big problems
CameronDev@programming.dev · 2 pts · 1y
A journalist or political figure can install a $5 VPN.
And even in their own example attack against the Discord CTO, their location got them down to 90% of the US. I could have guessed that without the attack.
Onomatopoeia@lemmy.cafe · 0 pts · 1y
If you can install another app on their phone already, then this really doesn't matter.
CameronDev@programming.dev · 16 pts · 1y
Quite overblown, this tracks people to the nearest cloudflare region. Not really de-anonymising, especially as you have to already know their contact details.
Onomatopoeia@lemmy.cafe · 0 pts · 1y
And have access to install another app on their phone.
If you're already getting another app on their phone, that app could lots more.
CameronDev@programming.dev · 2 pts · 1y
I think idea is that the app would already be there, for a journalist, having Signal is probably a given.