Zoom, Microsoft Teams, and Slack are popular, IT-supported collaboration platforms for larger organizations. You would suffer from significant challenges and limitations like inefficiency in work, limited access to information and reduced global connectivity and isolation. Signal’s security flaw was patched in September 2019, and the rest of the messaging apps were fixed more recently in the second half of 2020. The Project Zero researcher also looked at other popular messaging apps such as Telegram and Viber, but she could not find these particular security flaws.
Popular Messaging Apps
That code, which many apps (including banking, social media, and SMS-ID authentication systems) use as a second layer of security , is the master key. Sharing it, even “because a friend asked for it,” is tantamount to handing over control of the account on a silver platter. Once inside, the criminal can impersonate the victim to request money, access previous conversations, or extend the attack to other services linked to the same number.
Receiving Messages With Event Listeners
Recent research highlights critical weaknesses in these platforms, underscoring the delicate balance between functionality and security. This misconfiguration allows unauthorized attackers to access memory dumps containing potentially sensitive information, including authentication credentials, session tokens, and other confidential data stored in the application’s memory space. A critical security vulnerability in TeleMessageTM SGNL, an enterprise messaging system modeled after Signal, has been actively exploited by cybercriminals seeking to extract sensitive user credentials and personal data. Alongside international partners, the NCSC has issued actions for individuals at risk of targeted attacks against messaging apps. In this article, we explore how to identify and exploit postMessage vulnerabilities in modern web applications, ranging from basic origin validation bypasses to advanced DOM XSS chains that exploit insecure message handlers.
- PostMessage vulnerabilities can represent a significant attack surface in modern web applications, yet they often go undetected due to their client-side nature and the manual analysis required to identify them.
- In this article, we explore how to identify and exploit postMessage vulnerabilities in modern web applications, ranging from basic origin validation bypasses to advanced DOM XSS chains that exploit insecure message handlers.
- This data can be used to reconstruct social and professional networks, internal relationship maps within a company, travel habits, and even organizational hierarchies.
- Even in 2025, SMS-based attacks remain one of the easiest ways for adversaries to exploit signaling vulnerabilities in SS7, SIGTRAN, Diameter, and LTE networks.
- PostMessage-tracker is a Chrome extension specifically designed to monitor and log all postMessage communications.
This article explores how a single WeChat message can be leveraged for persistent client-side attacks, examining the technical mechanisms, real-world vulnerabilities, and WeChat’s layered security responses. PostMessage vulnerabilities can lead to numerous issues, such as DOM-based cross-site scripting and information disclosure. Understanding the full application context with the aim to learn how to weaponize this vulnerability type is key.
From smishing (SMS phishing) to interception of authentication codes, location tracking, and SMS flooding attacks, the humble text message has become a prime vector for telecom fraud and surveillance. Even in 2025, SMS-based attacks remain one of the easiest ways for adversaries to exploit signaling vulnerabilities in SS7, SIGTRAN, Diameter, and LTE networks. On an individual level, there are several guidelines anyone can follow to reduce their exposure when using messaging apps. The first is to treat phone numbers and codes received via SMS as sensitive credentials that should never be shared , even if the person requesting them appears to be a friend, a technician, or the app itself. Throughout this article, we will calmly but frankly examine why these tools are not harmless, what real risks they pose, and what alternatives and best practices exist to minimize the potential for disaster. The discovery, made by cybersecurity firm iVerify, reveals how attackers could compromise iPhones without any user interaction by exploiting a flaw in iMessage’s contact profile update feature.
The vast majority of desktop messaging clients are built on Electron, a framework that encapsulates a web application within a Chromium browser . This is very convenient for developers because it allows them to create a “native” app for multiple operating systems simultaneously, but it also means inheriting Chromium’s inherent vulnerabilities. Security experts recommend all iPhone users immediately update to the latest iOS version, with high-risk individuals particularly advised to enable Apple’s Lockdown Mode for additional protection against sophisticated zero-click attacks. Forensic examination of affected devices revealed suspicious activity consistent with known spyware cleanup procedures. On at least one device, directories related to SMS attachments and message metadata were modified and emptied just 20 seconds after the imagent crash occurred behavior that mirrors techniques observed in confirmed commercial spyware attacks. TeleMessage is similar to the Signal App but allows for the archiving of chats for compliance purposes.
This helps them to create more targeted spear-phishing attacks tailored to the target’s specific interests and characteristics. That incident demonstrated how messaging apps could be compromised at the development level, leading to widespread security breaches. Instant messaging (IM) applications like WhatsApp, Telegram, WeChat, and QQ have become the “digital arteries” of modern society, facilitating communication for billions of users worldwide. The federal cybersecurity agency strongly recommends that organizations immediately apply vendor-provided mitigations if available, emphasizing the critical nature of these security flaws. Instant messaging (IM) applications like WeChat have become indispensable for billions, facilitating not only communication but also payments, business, and personal data exchange.
Additionally, we can also notice that the data object the postMessage implementation expects includes the success, token and redirect_url properties. Untrusted Types is a browser extension that helps identify DOM XSS vulnerabilities by monitoring dangerous sinks in real-time. When enabled, it tracks data flow from sources (including postMessage event handlers) to sinks, such as innerHTML, and alerts you when untrusted data reaches a dangerous location. Below are a few free, open-source tools that can help test for DOM-based vulnerabilities, including postMessage bugs. The postMessage API was specifically designed as a controlled exception to this policy, allowing developers to explicitly enable safe, cross-origin communication when needed, provided it is used properly.
As an illustration, a messenger, even if classified as secure, may request some kind of registration data or a user’s phone number during sign-up. This information may be stored on servers or in the cloud and, in some cases, even remain unencrypted. Krebs on Security reports that a flood of E-ZPass and other toll road scam messages appear to has been generated by a Chinese phishing kit. WeChat’s Android client uses the XWEB engine, a Chromium-based browser lagging behind official releases (v130 vs. Chrome’s v136). Despite this, XWEB employs sandboxing, isolating rendering processes (xweb_sandboxed_process_0) from privileged ones to mitigate exploits. JSBridge interfaces, which enable web-to-native functions like scanQRCode, are tightly controlled via cloud-based permission arrays, limiting access for untrusted sites.
Burp Suite DOM Invader is a browser extension built into Burp Suite’s embedded browser that automatically detects DOM-based vulnerabilities, including postMessage bugs. DOM Invader monitors postMessage traffic, identifies message handlers, and can automatically test for XSS by injecting canary values into messages. It highlights potentially dangerous sinks and provides a visual representation of message flows. Modern applications often minify and obfuscate their JavaScript as part of optimizing site traffic, making manual review challenging. To counter this, use your browser’s developer tools to format the code, or leverage third-party services that aim to make the code more readable.
This chain of events effectively enables remote code execution (RCE) or content spoofing, which could be leveraged to drop payloads ranging from credential-stealing scripts to ransomware. Several days after top national security officials accidentally included a reporter in a Signal chat about bombing Houthi sites in Yemen, a Pentagon-wide advisory warned against using the messaging app, even for unclassified information. It’s a good idea to review the privacy settings of each app to limit who can see your profile picture, description, last seen time, or public profile.
Code scanners and secure development procedures are very important, but today they are becoming insufficient when it comes to finding critical vulnerabilities. Social lauradate.com engineering, malware, and spyware (like the infamous Pegasus) are among the most prevalent attack vectors targeting corporate devices. Reports indicate that the figures in the United States are even worse, averaging $9.44 million. These numbers fully explain the boom in bug bounty platforms – where businesses invite third-party experts to identify and test software vulnerabilities.