CVE-2022-28345
📋 TL;DR
This vulnerability in Signal for iOS allows attackers to spoof URLs using Right-to-Left Override (RTLO) characters combined with non-breaking spaces and hash characters. Attackers can create malicious links that appear to be legitimate websites (like example.com) but actually redirect to malicious destinations. Users of Signal for iOS before version 5.34 are affected.
💻 Affected Systems
- Signal for iOS
📦 What is this software?
Signal by Signal
⚠️ Risk & Real-World Impact
Worst Case
Users could be tricked into visiting malicious websites that steal credentials, install malware, or conduct financial fraud through convincing phishing attacks.
Likely Case
Successful phishing campaigns where users click spoofed links thinking they're visiting legitimate websites, potentially leading to credential theft.
If Mitigated
Users remain suspicious of all links and verify destinations before clicking, limiting successful phishing attempts.
🎯 Exploit Status
Exploitation requires sending messages to target users. Public proof-of-concept tools like RIUS demonstrate the technique.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.34 and later
Vendor Advisory: https://github.com/signalapp/Signal-iOS/releases
Restart Required: No
Instructions:
1. Open the App Store on iOS device 2. Search for Signal 3. Update to version 5.34 or higher 4. No restart required
🔧 Temporary Workarounds
Disable automatic URL rendering
iosConfigure Signal to not automatically render URLs in messages
User education
allTrain users to hover over links before clicking and verify URL destinations
🧯 If You Can't Patch
- Implement email/web filtering to block messages containing RTLO characters in URLs
- Deploy endpoint protection that warns users about potentially spoofed URLs
🔍 How to Verify
Check if Vulnerable:
Check Signal version in iOS Settings > Signal > Version. If below 5.34, vulnerable.Check Version:
Not applicable - check via iOS Settings appVerify Fix Applied:
Confirm Signal version is 5.34 or higher in iOS Settings > Signal > Version.📡 Detection & Monitoring
Log Indicators:
- Messages containing URLs with RTLO characters (U+202E)
- URLs with unusual subdomains like gepj, txt, fdp, xcod
Network Indicators:
- Unusual redirect patterns from Signal messages
- Connections to unexpected domains following Signal links
SIEM Query:
search 'U+202E' OR 'RTLO' OR 'right-to-left override' in message logs🔗 References
- https://blog.malwarebytes.com/social-engineering/2022/03/uri-spoofing-flaw-could-phish-whatsapp-signal-instagram-and-imessage-users/
- https://github.com/sickcodes/security/blob/master/advisories/SICK-2022-42.md
- https://github.com/zadewg/RIUS
- https://sick.codes/sick-2022-42
- https://blog.malwarebytes.com/social-engineering/2022/03/uri-spoofing-flaw-could-phish-whatsapp-signal-instagram-and-imessage-users/
- https://github.com/sickcodes/security/blob/master/advisories/SICK-2022-42.md
- https://github.com/zadewg/RIUS
- https://sick.codes/sick-2022-42
