A pair of damning advisories independently published Wednesday raise serious questions about the security assurances of Confide, a messaging app that’s billed as providing “battle tested, military grade” end-to-end encryption and is reportedly being used by individuals inside the US government.
One of the bulletins, published by security firm Quarkslab, warned that current versions of Confide—including those available for Macs, PCs, iPhones, Android devices, and Apple Watches—don’t provide true end-to-end encryption at all, at least as that term is commonly defined. Unlike competing secure messaging app Signal—which prevents even authorized insiders from accessing the keys needed to decrypt messages—Confide engineers, or people who hack the Confide service, can easily create keys that can be used to decrypt messages as they’re sent in real time.
Quarkslab researcher Jean-Baptiste Bédrune tested Confide and found that the main encryption layer protecting messages in transit is transport layer security (TLS), a protocol that’s trivial for authorized people inside Confide to turn off. TLS has faced its share of bypass hacks over the more than two decades it has been in use. In Wednesday’s post Bédrune wrote:
The end-to-end encryption used in Confide is far from reaching the state of the art. Building a secure instant messaging is not easy, but when claiming it, some strong mechanisms should really be enforced since the beginning.
The confidentiality of the exchanged messages depends on the robustness of TLS. Confide can technically read all the messages that pass through its servers. End-to-end encryption, as it is implemented, solely relies on the server through which the messages pass.
To prove the point, the researcher modified a Confide app to bypass TLS protections so that it behaved as if Quarkslab was in the same position as it would be in Confide’s own network. He quickly discovered that the Confide protocol—which governs the way apps on all supported platforms behave—provides no mechanism allowing the receiver to verify the origin of the message or the authenticity of the sender. Instead, Confide simply decrypts the message without verifying its integrity. He wrote:
Thus, the Confide server could generate its own key pair and transmit the public part to a client when the latter requests the public key of a recipient (we only note that Confide is able to do so, not that it does so). This client then unknowingly encrypts a message that can be decrypted by the server. Finally, when the server sends the message to the recipient, it is able to re-encrypt the message with its own key for the actual recipient.
This is a classic man-in-the-middle attack against Diffie-Hellman based protocols, which works by design of the Confide protocol. Confidentiality of the communications is in fact provided by TLS, and not by the end-to-end encryption mechanism provided by Confide. This limits the possibilities of MitM to the Confide server, which acts here as a trusted third party.
But wait, there’s more
To make matters worse, the Confide protocol currently offers no mechanism for synchronizing keys used by different devices. When a user wants to connect a new device to an existing account, a new public key is sent to the Confide server and is added to the user’s key set. A user can end up having several keys, and Confide provides no way for users to check the key set or revoke individual keys. Bédrune drew two conclusions from this lack of synchronization:
- The Confide server can add a key when it returns a user’s profile. The sender of a message then protects the message key with the recipient real public key and the one added by the server. There is no way to detect this.
- The end-to-end encryption mechanism provides a very low protection: the overall security of communications is based on TLS. Without this layer, the compromise of communications would be trivial. An attacker in the middle man position could inject a public key when sending a user’s profile to the server, and decrypt messages sent on the fly.
Quarkslab also found that two other key Confide security features—one that securely deletes messages and another that prevents the taking of screenshots—could also be defeated. The security company said it would provide more details in a future post.
In a statement, a Confide official dismissed the legitimacy of the research. The statement said:
The researchers intentionally undermined the security of their own system to bypass several layers of Confide’s protection, including application signatures, code obfuscation, and certificate pinning. The attack that they claim to be demonstrating does not apply to legitimate users of Confide, who are benefiting from multiple security protections that we have put in place. Undermining your own security or taking complete control of a device makes the entire device vulnerable, not just the Confide app.
Like with Apple’s iMessage and other end-to-end encrypted messengers, it is theoretically possible that we could man-in-the-middle attack ourselves. Obviously, we would never do this. We will also soon be releasing an update that adds support for independent fingerprint verification, further ensuring that conversations are end-to-end encrypted and that only the intended recipients can read their messages.
The statement is notable for several reasons. First, the modified app merely put Bédrune in the same position Confide servers are in. Had Signal undergone the same modifications, its true end-to-end encryption would have prevented the researcher from carrying out the same decryption attacks. What’s more, the second paragraph effectively confirms Bédrune’s claim that Confide could decrypt any message that passed through its servers. Last, “we would never do this” is antithetical to any claim of “battle tested military grade” end-to-end encryption. True end-to-end encryption means “I can’t.”
The Quarkslab critique came around the same time that IOActive, a separate security company, issued its own Advisory regarding Confide. It found “numerous security issues,” including the same lack of fingerprint authentication reported by Quarkslab. Like Quarkslab, IOActive warned this allowed Confide to conduct man-in-the-middle attacks. Other flaws included:
- A message notification system that didn’t require a valid TLS certificate for apps to communicate with the server, an omission that would expose session information to people sharing the same network as an end user
- The ability of the app to transmit unencrypted messages with no warning
- Files that uploaded before a user sent the message they were attached to
- A failure to use authenticated encryption, which allowed Confide to alter messages in transit
- A weakness in the app that allowed attackers to obtain real names, e-mail addresses, and phone numbers associated with all user accounts
- The failure to prevent brute-force attacks on user account passwords and the acceptance of easy-to-guess passwords
“Testing versions 4.0.4 for Android and 1.4.2 for Windows and OS X, IOActive was able to recover over 7,000 records for users registered between the dates of 2017-02-22 to 2017-02-24,” the advisory warned. “This data also indicated that between 800,000 and one million user records were potentially contained in the database.”
The advisory went on to say that Confide had fixed “issues identified as critical” but didn’t say precisely which ones it was referring to. In the statement, the Confide official wrote:
“Our security team is continuously monitoring our systems to protect our users’ integrity and we were able to detect anomalous behavior and remediate many of the issues during IOActive’s testing in real time. Not only have these issues been resolved, but we also have no detection of them being exploited by any other party.”
The statement didn’t explain why IOActive was able to obtain 7,000 user records if the anomalous behavior was detected and remediated in real time.
Quarkslab’s Bédrune said that Confide officials have been responsive and plan to fix the flaws he has reported. Still, taken together, the reports demonstrate a surprising lack of rigor for the maker of a confidential messenger that claims to offer end-to-end encryption. For people who are really counting on their messages being private, Signal or WhatsApp are undoubtedly better choices.