Unique 0-click deanonymization attack targeting Signal, Discord and hundreds of platform discovered by a 15-year-old high school kid

shuvashish76 · January 24, 2025, 5:59pm

gist.github.com

https://gist.github.com/hackermondev/45a3cdfa52246f1d1201c1e8cdef6117

research.md

hi, i'm daniel. i'm a 15-year-old high school junior. in my free time, i [hack billion dollar companies](https://hackerone.com/daniel) and build cool stuff.

3 months ago, I discovered a unique 0-click deanonymization attack that allows an attacker to grab the location of any target within a 250 mile radius. With a vulnerable app installed on a target's phone (or as a background application on their laptop), an attacker can send a malicious payload and deanonymize you within seconds--and you wouldn't even know.

I'm publishing this writeup and research as a warning, especially for journalists, activists, and hackers, about this type of undetectable attack. Hundreds of applications are vulnerable, including some of the most popular apps in the world: Signal, Discord, Twitter/X, and others. Here's how it works:

# Cloudflare
By the numbers, Cloudflare is easily the most popular CDN on the market. It beats out competitors such as Sucuri, Amazon CloudFront, Akamai, and Fastly. In 2019, a major Cloudflare outage knocked most of the internet offline for over 30 minutes.

One of Cloudflare's most used feature is Caching. Cloudflare's Cache stores copies of frequently accessed content (such as images, videos, or webpages) in its datacenters, reducing server load and improving website performance (https://developers.cloudflare.com/cache/).

This file has been truncated. show original

“We believe bug bounties are a vital part of every security team’s toolbox, and continue to encourage third parties and researchers to continue to report this type of activity for review by our team.” - Cloudflare spokesperson

Amount: only $200 bounty

Responding to a subsequent request, Cloudflare told the researcher that it is ultimately the users’ responsibility to disable caching.

Discord rejected the report as a Cloudflare issue, as did Signal, noting that it’s outside their mission’s scope to implement network-layer anonymity features.

Of course it’s users’ responsibility…

dalto · January 24, 2025, 6:10pm

I think it really is the user’s responsibility. This is an inherent design issue in what the service is doing, not a bug. It is about using the service properly for a given use-case. Geo-based content caching isn’t designed to be private or privacy enhancing.

Keep in mind, the “user” in this case isn’t you and me. It is the consuming application that are the user’s of their service. In this case, it is Discord, Signal and friends.

So if those apps are selling privacy, they shouldn’t be using this type of service.