Affiliation:
1. University of Würzburg, Bavaria, Germany
2. Royal Holloway, University of London, Surrey, United Kingdom
3. Technical University of Darmstadt, Hesse, Germany
Abstract
Contact discovery allows users of mobile messengers to conveniently connect with people in their address book. In this work, we demonstrate that severe privacy issues exist in currently deployed contact discovery methods and propose suitable mitigations.
Our study of three popular messengers (WhatsApp, Signal, and Telegram) shows that large-scale crawling attacks are (still) possible. Using an accurate database of mobile phone number prefixes and very few resources, we queried 10 % of US mobile phone numbers for WhatsApp and 100 % for Signal. For Telegram, we find that its API exposes a wide range of sensitive information, even about numbers not registered with the service. We present interesting (cross-messenger) usage statistics, which also reveal that very few users change the default privacy settings.
Furthermore, we demonstrate that currently deployed hashing-based contact discovery protocols are severely broken by comparing three methods for efficient hash reversal. Most notably, we show that with the password cracking tool “JTR,” we can iterate through the entire worldwide mobile phone number space in < 150 s on a consumer-grade GPU. We also propose a significantly improved rainbow table construction for non-uniformly distributed input domains that is of independent interest.
Regarding mitigations, we most notably propose two novel rate-limiting schemes: our
incremental
contact discovery for services without server-side contact storage strictly improves over Signal’s current approach while being compatible with private set intersection, whereas our
differential
scheme allows even stricter rate limits at the overhead for service providers to store a small constant-size state that does not reveal any contact information.
Publisher
Association for Computing Machinery (ACM)
Subject
Safety, Risk, Reliability and Quality,General Computer Science
Reference112 articles.
1. Affinityclick. 2013. Hushed - Private Phone Numbers Talk and Text. Retrieved from https://hushed.com/.
2. Parry Aftab. 2014. Findings under the Personal Information Protection and Electronic Documents Act (PIPEDA). Retrieved from https://parryaftab.blogspot.com/2014/03/what-does-whatsapp-collect-that.html.
3. Martin Albrecht, Lenka Mareková, Kenneth Paterson, and Igors Stepanovs. 2022. Four attacks and a proof for Telegram. In IEEE Symposium on Security and Privacy (S&P). IEEE.
4. Backes SRT. 2013. WhatsBox - GDPR Compliant WhatsApp. Retrieved from https://www.backes-srt.com/en/solutions-2/whatsbox/.
5. Marco Balduzzi, Christian Platzer, Thorsten Holz, Engin Kirda, Davide Balzarotti, and Christopher Kruegel. 2010. Abusing social networks for automated user profiling. In Recent Advances in Intrusion Detection (RAID). Springer, 422–441.
Cited by
1 articles.
订阅此论文施引文献
订阅此论文施引文献,注册后可以免费订阅5篇论文的施引文献,订阅后可以查看论文全部施引文献