Apple Stops Weirdly Storing Data That Let Cops Spy On Signal Chats (arstechnica.com) 34
Apple has fixed a bug that could cause parts of Signal notifications to remain stored on iPhones even after messages disappeared and the app was deleted. "Affected users concerned about push notifications can update their devices to stop what Apple characterized as 'notifications marked for deletion' that 'could be unexpectedly retained on the device,'" reports Ars Technica. "According to Apple, the push notifications should never have been stored, but a 'logging issue' failed to redact data." From the report: Vulnerable users hoping to evade law enforcement surveillance often use encrypted apps like Signal to communicate sensitive information. That's why users felt blindsided when 404 Media reported that Apple was unexpectedly storing push notifications displaying parts of encrypted messages for up to a month. This occurred even after the message was set to disappear and the app itself was deleted from the device.
404 Media flagged the issue after speaking to multiple people who attended a hearing where the FBI testified that it "was able to forensically extract copies of incoming Signal messages from a defendant's iPhone, even after the app was deleted, because copies of the content were saved in the device's push notification database." The shocking revelation came in a case that 404 Media noted was "the first time authorities charged people for alleged 'Antifa' activities after President Trump designated the umbrella term a terrorist organization." "We're grateful to Apple for the quick action here, and for understanding and acting on the stakes of this kind of issue," Signal's post said. "It takes an ecosystem to preserve the fundamental human right to private communication."
In their post, Signal confirmed that after users update their devices, "no action is needed for this fix to protect Signal users on iOS. Once you install the patch, all inadvertently-preserved notifications will be deleted and no forthcoming notifications will be preserved for deleted applications."
404 Media flagged the issue after speaking to multiple people who attended a hearing where the FBI testified that it "was able to forensically extract copies of incoming Signal messages from a defendant's iPhone, even after the app was deleted, because copies of the content were saved in the device's push notification database." The shocking revelation came in a case that 404 Media noted was "the first time authorities charged people for alleged 'Antifa' activities after President Trump designated the umbrella term a terrorist organization." "We're grateful to Apple for the quick action here, and for understanding and acting on the stakes of this kind of issue," Signal's post said. "It takes an ecosystem to preserve the fundamental human right to private communication."
In their post, Signal confirmed that after users update their devices, "no action is needed for this fix to protect Signal users on iOS. Once you install the patch, all inadvertently-preserved notifications will be deleted and no forthcoming notifications will be preserved for deleted applications."
Re: (Score:2)
Won't happen, in fact, Apple was probably given a short timeline to fix it. Why? Because Signal is an approved application for contractors to communicate with government employees, including Secret and Top Secret.calls as long as everyone on the call is approved. I've been on some of these calls. Not that anything that needed to be classifeid was ever discussed.
Big picture problem (Score:5, Interesting)
Re: (Score:3)
It's a common problem with Apple. They just don't seem to have the privacy/security mindset when developing new features.
Sometimes it's catastrophic, like AirTags.
Re: (Score:2)
Or it's just weird edge cases. Like having to display a notification for an app that no longer is on the device. It was stored for later display, then when it was reaped to display, the app no longer exists and it gets logged because it's likely an error that shouldn't occur because deleting the app should've cleared the notification queue of those messages. So it gets logged in the system log that something that shouldn't happen, happened.
Of course, the other culprit is Signal itself, since it would be pas
Re: (Score:2)
Signal gives you options to show no notification, only notify that a message was received, show the sender's name only, or show the message text. It warns you about security implications. The user has to make a decision to enable this.
Re: (Score:2)
Or, as Robert Morris Sr. said about breaking confidential communications, "Look for plaintext. It comes up in the darnedest place", or words to that effect.
Weirdly (Score:5, Interesting)
Apple Stops Weirdly Storing Data That Let Cops Spy On Signal Chats
So... now they're just storing it - non-weirdly? Not sure how that's better.
Apple has fixed a bug that ...
Oh, you meant, "incorrectly" or "unintentionally".
(*sigh*)
Re:Weirdly (Score:4, Funny)
Re: Weirdly (Score:2)
Doesn't the App have to ask for notifications? (Score:1)
Also I think apps have options for notifctions. They don't have to be previews of the communication. They could simply be a "bing" noise and a counter on the app icon indicating unread messages. The operating system never seeing communications content in the latter case.
even non-preview notifications can be a problem (Score:2)
Even non-preview notifications can be a compromise. Metadata, as usual.
Let's say some malevolent agency got the unlocked phone of your friend, with messages (perhaps "let's meet at the docks at 9:00", "are you there" ...) sent to a Signal username at specific times.
And then you have OS notifications "you have a Signal message" done at exactly that times + processing delay. That would be a bit revealing.
Re: (Score:2)
Furthermore, it's easy to further obfuscate this by making the time window even longer, or adding a random delay. For example by only notifying every 5 minutes, or every hour - how many Signal messages worldwide are sent in one hour?
Re: (Score:2)
Yes, obfuscation may help a bit. Even if people probably want a notification within - perhaps 30s?
And note that this isn't about Signal metadata, but from the Signal app to the OS. if you have the notifications for *single device* and they match the time stamps of a sender within 5 min, with no other notifications (if you only communicated with that sender), it may be indicative, even there is some p for it being a coincidence.
Re: (Score:2)
Re: (Score:2)
Doesn't the App have to ask for notifications? That seems like an app flaw, intentionally turning over its data to operating system functionality it has no control over.
The assumption was that any app notification would not be stored after than notification is gone. Something up on your screen at time "x" has a different risk profile than something that still exists on the system at time "x+y". It was a relatively good assumption as well given the operating system actually provides API level control over if a notification is sensitive or not (how much information is displayed when something is unlocked). There's no reason to not hand over data to a system you believe is ha
Re: (Score:2)
The assumption was that any app notification would not be stored after than notification is gone. Something up on your screen at time "x" has a different risk profile than something that still exists on the system at time "x+y". It was a relatively good assumption as well given the operating system actually provides API level control over if a notification is sensitive or not (how much information is displayed when something is unlocked). There's no reason to not hand over data to a system you believe is handling it correctly.
I don't agree with this. The push notification is passed on to Apple systems. I don't think you can say it's necessarily an operating system system issue, because push notifications can hit multiple devices (watch, phone, ipad, laptop, etc.) on multiple operating systems. So notifications have to go through Apple servers.
I think the question is whether you trust the Apple servers and all your various devices that are logged into your account.
For extremely sensitive data, I would say no!
I'm glad Apple is mak
Re: (Score:2)
Doesn't the App have to ask for notifications? That seems like an app flaw, intentionally turning over its data to operating system functionality it has no control over.
The assumption was that any app notification would not be stored after than notification is gone.
And isn't that just the explanation for the mistake that Signal made? Again, they are turning over data to code they have no control over. Apple has a tendency to send message to all devices a user has. If you have Signal on your phone and your Mac, how is Apple handling the message? Historically deleting a message on one device does not necessarily delete it on the other device. Honestly, it's quite surprising that Signal trusted Apple in this regard. I would hope such an app would not use the operating sy
Re: (Score:2)
If you argue like "an app flaw, intentionally turning over its data to operating system functionality it has no control over" you may not run on any operation system you cannot fully trust. If you think iOS may log your messages, then you must also assume it interferes with how the app runs.
Re: (Score:2)
If you argue like "an app flaw, intentionally turning over its data to operating system functionality it has no control over" you may not run on any operation system you cannot fully trust. If you think iOS may log your messages, then you must also assume it interferes with how the app runs.
A notification to all of a users's devices associated with an Apple ID sounds like an entirely different level of potential risk than printing something on a screen. Keep in mind that the incoming data should have been encrypted and stayed that way until immediately before printing.
Shitty Extrapolation (Score:4, Insightful)
No, they are not "spying". They've seized the device and forensically extracted the notification text from internal logs. The point of spying is that those spied upon don't know you can see them. Now if they had snagged the device, installed a log capture and forward sniffer on it, and returned it without the user knowing, THAT would be spying.
Between that shitty summary and the use of the word "weirdly", it's clearly just bait. Move along.
If Signal really wanted to be properly sandboxed and secure, they wouldn't be dumping stuff into notifications... but that's a different complaint.
Re: (Score:2)
Speaking of forensics, if you're a law-abiding citizen who just wants to keep private information private, iOS lockdown mode will reported halt the Coruna forensics tool in its tracks. Source, Eva Galperin at EFF. It's a royal PITA to use though.
Signal's fault (Score:1)
How about not putting sensitive data into notifications in the first place? Signal needs to decide if it's a security app or a trendy chat app.
Re: (Score:2)
Our backdoor got found :o (Score:2)
By "Cops", you mean I.C.E. right? (Score:2)
In as much as ACAB, it's far more likely that ICE is tapping into things like that for their nefarious schemes. At least Apple seems to have stopped for the moment. I wonder what other chat and/or message systems they have their little worms running through.
A bit more nuanced than that (Score:4, Informative)
It's bug that shouldn't have existed in the first place and it deserved to be fixed. However, to get the message stored in the notification database, the user needed to change the default setting and allow messages to be displayed on the screen of a locked phone.
If you've chosen to have messages displayed on the screen of a locked phone, you're basically saying you're not concerned about keeping the messages secure, so the user bears some responsibility here.
Why only the FBI? China does worse... (Score:1)
I find it amusing that Apple will go to great pains to fix their code when it is the FBI, but when the People's Police ask for stuff, it seems like Apple and others happily give it to them... and you NEVER hear about Apple working on privacy issues when it comes to law enforcement from China.
It shows the US's LEOs are an easy target, because if that stuff is tried in another company, at best Apple would be banned. At worst, all offices would get raided, and officials and company officers disappeared.