Confide, the secure-messaging service used by many staffers in the White House and on Capitol Hill, turned out to not be very secure after all.
So says a report released today (March 8) by IOActive, a well-regarded Seattle security firm. IOActive researchers found that Confide let attackers hijack user sessions, successfully guess user passwords, steal contact information, eavesdrop on conversations and even hack into messages or message attachments.
IOActive called Confide's security flaws "critical," and noted that its researchers gained access to the account records of 7,000 Confide users, including usernames, phone numbers, email addresses and public cryptographic keys.
IOActive said it had informed Confide's developers, and that all the flaws it found should have been fixed in the service's latest software updates for Windows, Mac, Android and iOS. If you use Confide, update the software now.
MORE: Best Encrypted Messaging Apps
For a supposedly secure messenger, it sounds like Confide had more holes than Swiss cheese. The IOActive report noted that the application didn't properly validate messages, "which would leak session information to actors performing a man-in-the-middle attack."
The service allowed unencrypted messages to be sent without notifying the receiver that the messages would be readable to anyone, and that "the application failed to adequately prevent brute-force attacks on user account passwords," which could be short and simple instead of long and complex, making the task of guessing a password even easier.
The IOActive team also found that the "application allowed an attacker to enumerate all Confide user accounts, including real names, email addresses, and phone numbers."
IOActive didn't elaborate on how its researchers pulled that off, but similar account harvesting has occurred when an attacker pinged a database with a valid user ID, and received private, personal information related to that user. If that's the case here, then it might have been possible to automate database queries to harvest a lot of account information in a short time.
IOActive told Confide about these flaws last month, and updated versions that fixed the problems began rolling out last week.
