The researcher also wasn’t able to determine a person’s specific address, for example. The method isn’t 100% reliable at one point, Wells called an associate in Pennsylvania as an experiment, and the associated DNS server that responded was 400 miles away in Toronto. Signal recently announced it would be rolling out PIN numbers for people to use instead of phone numbers, which may help plug the security hole. Signal declined to publicly comment when asked about the reported vulnerability, but Wells told Digital Trends that he heard the team was working on an update that would patch the problem. Signal has reportedly already released a patch for the vulnerability via Github, but as of now, it is not yet available through any app stores. “It’s not like clicking on a link ,” he said. Simply by calling your phone, which you can’t control, a threat actor could determine your general location.” “The core of the issue is that you’re helpless,” Wells said. By getting that information, I know what DNS server you’re using and I can determine your general location.” “So I can force that DNS server to talk to me.
“Usually, it’ll be somewhat near you,” Wells continued. It turns out that’s enough for the caller to see what DNS server your phone automatically connects to. “Let’s say I have a burner phone and I just ring your phone, and I do it so quickly that all you see is a missed call from some number,” Wells said. This works even if you don’t pick up or see the call. It turns out that even if you don’t have a person in your contacts list, they can still roughly determine your rough location just by calling you on Signal. “That feature is not well advertised, and it’s interesting that someone could disclose your location if they’re your contact,” Wells said. This Microsoft Teams exploit could leave your account vulnerableįacebook’s massive outage saw millions sign up for rival apps This major Apple bug could let hackers steal your photos and wipe your device
0 kommentar(er)
