Confide Secure-Message App Wasn't So Secure After All

Confide, the secure-messaging service used by many staffers in the White House and on Capitol Hill, turned out to not be very secure after all.

Credit: Confide — (Image credit: Confide)

IOActive called Confide's security flaws "critical," and noted that its researchers gained access to the account records of 7,000 Confide users, including usernames, phone numbers, email addresses and public cryptographic keys.

IOActive said it had informed Confide's developers, and that all the flaws it found should have been fixed in the service's latest software updates for Windows, Mac, Android and iOS. If you use Confide, update the software now.

MORE: Best Encrypted Messaging Apps

For a supposedly secure messenger, it sounds like Confide had more holes than Swiss cheese. The IOActive report noted that the application didn't properly validate messages, "which would leak session information to actors performing a man-in-the-middle attack."

The service allowed unencrypted messages to be sent without notifying the receiver that the messages would be readable to anyone, and that "the application failed to adequately prevent brute-force attacks on user account passwords," which could be short and simple instead of long and complex, making the task of guessing a password even easier.

The IOActive team also found that the "application allowed an attacker to enumerate all Confide user accounts, including real names, email addresses, and phone numbers."

IOActive didn't elaborate on how its researchers pulled that off, but similar account harvesting has occurred when an attacker pinged a database with a valid user ID, and received private, personal information related to that user. If that's the case here, then it might have been possible to automate database queries to harvest a lot of account information in a short time.

IOActive told Confide about these flaws last month, and updated versions that fixed the problems began rolling out last week.

TOPICS

Paul Wagenseil is a senior editor at Tom's Guide focused on security and privacy. He has also been a dishwasher, fry cook, long-haul driver, code monkey and video editor. He's been rooting around in the information-security space for more than 15 years at FoxNews.com, SecurityNewsDaily, TechNewsDaily and Tom's Guide, has presented talks at the ShmooCon, DerbyCon and BSides Las Vegas hacker conferences, shown up in random TV news spots and even moderated a panel discussion at the CEDIA home-technology conference. You can follow his rants on Twitter at @snd_wagenseil.