In this work, we analyse the revised security architecture of Bridgefy and report several vulnerabilities. The headline news is that we found a practical attack, with a proof-of-concept implementation, that breaks confidentiality of libsignal-protected private messages and succeeds with a probability of about 50%. Please note that this attack in no way threatens Signal or libsignal but attacks how Bridgefy uses it.
Our other findings include:
- Bridgefy users can still be tracked.
- Broadcast messages remain unauthenticated; an attacker can exploit this to mount impersonation attacks.
- The protocol remains susceptible to an attacker in the middle. While such an attack is now limited to the first exchange between a pair of users (i.e., it abuses a “trust on first use” or TOFU assumption) we note that Bridgefy offers users no option to verify the public keys of their contacts.
- Any nodes in the network that receive a single carefully crafted message become unable to participate in further network communication.
- The broadcast encryption mechanism employed by the Bridgefy SDK is susceptible to a ciphertext-only attack with the assumption of plaintexts from a small domain. The Bridgefy messenger not affected by this.
We disclosed our first vulnerabilities to Bridgefy in May 2021. According to the developers, the vulnerability allowing an attacker to read encrypted messages was fixed on 14 August 2021. The disclosure of our attacks on the broadcast encryption followed in September 2021. We asked the developers to comment on the remediation progress in early February 2022, however, at the time of writing the state of the remediation remains unclear.
We recommend that users avoid Bridgefy until its developers have committed to regular public security audits by respected third party auditors.
We are academic researchers from ETH Zurich and Royal Holloway:
- Martin R. Albrecht (Information Security Group, Royal Holloway, University of London)
- Raphael Eikenberg (Applied Cryptography Group, ETH Zurich)
- Kenneth G. Paterson (Applied Cryptography Group, ETH Zurich)