Send and Pretend: Exploiting Transcript Consistency Issues in E2EE Group Chats

8 hours ago

End-to-end encrypted (E2EE) messaging apps are praised for security but used for sensitive group coordination, yet they lack transcript consistency (TC), allowing malicious participants to manipulate message delivery.
Major E2EE messengers (including Signal and iMessage) do not guarantee TC for group chats, enabling selective omission, reordering, or alteration of content without user warnings.
Multiple equivocation vectors exist, including protocol fallback paths and deliberate use of pairwise delivery channels within groups, leading to exploitation scenarios like social engineering, moderation evasion, and poll rigging.
Implementation-specific behaviors with privacy implications, such as device OS fingerprinting, were also uncovered.
The paper proposes practical low-overhead mitigations and UI signaling strategies to integrate TC into state-of-the-art E2EE group protocols.

Group chats on major messaging services are end-to-end encrypted but vulnerable to content manipulation by malicious group members or compromised devices.
Attackers can send messages with the same ID but different content to different recipients, breaking transcript consistency.
Examples include fake meeting invitations, manipulated polls, and hidden malware links disguised as harmless content.

The W3C is developing end-to-end encryption (E2EE) for ActivityPub, separate from a key transparency proposal for the Fediverse.
Three main goals are outlined: enabling E2EE messaging (Fundamental), ensuring correct encryption (Security), and verifiably authenticating user keys without central authority (Authenticity).
Key transparency provides a decentralized root of trust by logging which ActivityPub actor controls which signing keys, addressing authenticity.

Confidential computing relies on remote attestation to prove a server runs in a genuine Trusted Execution Environment (TEE) before sharing sensitive data.
New research reveals flaws in attested TLS protocols used in confidential computing, allowing relay attacks where a client’s connection can be redirected to a compromised server without detection.
The study formalizes three levels of cryptographic binding for attestation, with level three (tying evidence to application traffic keys) potentially unattainable in current intra-handshake architectures.

EU law does not currently apply to end-to-end encrypted messages on platforms like WhatsApp and Signal.
A temporary regulation allows voluntary scanning of unencrypted messages for child sexual abuse material (CSAM) until 2028.
A permanent proposal, 'Chat Control 2.0', is under negotiation and may extend scanning to encrypted chats.

Delta Chat 2.48+ releases minimize metadata exposure to servers via full header protection.
Outer Date header is randomized to prevent timestamp correlation attacks.
SecureJoin v3 hides cryptographic identities and ensures forward/backward compatibility.

Group chats on major messaging services are end-to-end encrypted but vulnerable to content manipulation by malicious group members or compromised devices.
Attackers can send messages with the same ID but different content to different recipients, breaking transcript consistency.
Examples include fake meeting invitations, manipulated polls, and hidden malware links disguised as harmless content.

The W3C is developing end-to-end encryption (E2EE) for ActivityPub, separate from a key transparency proposal for the Fediverse.
Three main goals are outlined: enabling E2EE messaging (Fundamental), ensuring correct encryption (Security), and verifiably authenticating user keys without central authority (Authenticity).
Key transparency provides a decentralized root of trust by logging which ActivityPub actor controls which signing keys, addressing authenticity.

Confidential computing relies on remote attestation to prove a server runs in a genuine Trusted Execution Environment (TEE) before sharing sensitive data.
New research reveals flaws in attested TLS protocols used in confidential computing, allowing relay attacks where a client’s connection can be redirected to a compromised server without detection.
The study formalizes three levels of cryptographic binding for attestation, with level three (tying evidence to application traffic keys) potentially unattainable in current intra-handshake architectures.

EU law does not currently apply to end-to-end encrypted messages on platforms like WhatsApp and Signal.
A temporary regulation allows voluntary scanning of unencrypted messages for child sexual abuse material (CSAM) until 2028.
A permanent proposal, 'Chat Control 2.0', is under negotiation and may extend scanning to encrypted chats.

Delta Chat 2.48+ releases minimize metadata exposure to servers via full header protection.
Outer Date header is randomized to prevent timestamp correlation attacks.
SecureJoin v3 hides cryptographic identities and ensures forward/backward compatibility.

Hasty Briefsbeta