Signal App Information Disclosure

CVE-2020–5753 - Remote DNS Disclosure

Signal Messenger App has a vulnerability which allows a remote non-contact to ring a user's Signal phone and disclose the Signal user's current DNS server. We found Android Signal versions v4.59.0-4.58.10 to be vulnerable and iOS Signal versions v3.8.0.34-v3.8.3.5 vulnerable. 

The impact can result in a remote attacker obtaining coarse information via leaking DNS server IP of a Signal user, which may disclose coarse location as well as changes in internet connections at any given moment. In the event the Signal user is using a DNS that uses EDNS Client Subnet, then part of the Signal user's IP address could also be disclosed which results in finer location and network disclosure. 

Cause

The issue lies in how WebRTC is used to processes ICE Candidates, which takes place before a user decides to answer an incoming Signal call. While a callee's IP address can be hidden from the ICE Candidate exchange using Signal "Always Relay Calls" setting, ICE Candidates support domain names which allows an attacker to force a callee to resolve during the signaling process. If the attacker owns the authoritative nameserver for given domain, then callee's current DNS server is disclosed.