CVE-2019-9970 : What You Need to Know

Open Whisper Signal (aka Signal-Desktop) and Signal Private Messenger app are vulnerable to an IDN homograph attack when displaying URLs.

Understanding CVE-2019-9970

What is CVE-2019-9970?

This CVE identifies a security vulnerability in Open Whisper Signal and Signal Private Messenger app related to an IDN homograph attack when displaying URLs.

The Impact of CVE-2019-9970

The vulnerability allows malicious actors to create URLs with visually similar characters, leading users to believe they are legitimate links, potentially resulting in phishing attacks or malware installation.

Technical Details of CVE-2019-9970

Vulnerability Description

The issue arises when the applications generate clickable links for URLs containing both Latin and Cyrillic characters in the domain name, exploiting font similarities.

Affected Systems and Versions

Open Whisper Signal (Signal-Desktop) up to version 1.23.1
Signal Private Messenger app for Android up to version 4.35.3

Exploitation Mechanism

Malicious actors can craft URLs with mixed character sets to deceive users
Vulnerability triggered when the font used can represent characters from different alphabets identically

Mitigation and Prevention

Immediate Steps to Take

Avoid clicking on URLs from untrusted sources
Update Open Whisper Signal and Signal Private Messenger to the latest versions

Long-Term Security Practices

Educate users on phishing awareness and URL safety
Implement URL scanning and filtering mechanisms

Patching and Updates

Regularly check for software updates and security patches from the official sources