Nothing, the vendor of Nothing Chat a re-skin of Sunbird app, was discovered to provide a subpar E2E encryption chat app for Android users, in this ArsTechnica.com article: https://arstechnica.com/gadgets/2023/11/nothings-imessage-app-was-a-security-catastrophe-taken-down-in-24-hours/ Nothing has suspended their app, until they can fix their security issues, which were discovered by the broader Internet community.
The following issues were identified with Nothing’s E2E app:
- Apple ID and password shared with site,
- Sunbird actually logged and stored messages in plain text on both the error reporting software Sentry and in a Firebase store,
- Authentication tokens were sent over unencrypted HTTP (TCP-80/HTTP) so this token could be intercepted and used to read your messages, and
- “When a message or an attachment is received by a user, they are unencrypted on the server side until the client sends a request acknowledging, and deleting them from the database. This means that an attacker subscribed to the Firebase Realtime DB will always be able to access the messages before or at the moment they are read by the user.”
Conclusion
Per the article, “Içöz recommends that any Sunbird/Nothing Chat users change their Apple password now, revoke Sunbird’s session, and ‘assume your data is already compromised.'” Frankly, I’m amazed the Apple and Play Store don’t start having developers answer a quiz to determine whether their app merits posting into their “Walled Garden,” but perhaps, they already do and this is merely a response by the Internet community that does check each apps claims regarding “security standards” or claims.
For those interested, there are several things they should be ensuring (encryption) secure data “at rest,” “in use” (in memory), and “in motion.”
Security “at rest” is as you’d expect. It ensures that the data stored on the hard drive, when it’s not part of the “hot”/”active” data set is properly encrypted and secured. Security “in use” (or in memory) is ensuring that snooping can’t occur while the user is using it; it’s often associated with sessions. Unfortunately, the Intel Spectre, Intel Meltdown, and “AMD RETbleed” vulnerabilities open this problem because if the processor can be attacked to divulge data in (active) memory, all data on the system is vulnerable. In some cases, Intel or AMD can release microcode for x86 Chipset architectures so check with your motherboard vendor to ensure proper U/EFI (or BIOS) patching; ARM/RISC-V systems haven’t been identified as being vulnerable to these attacks, yet. And finally, security “in motion” is associated with transport data; security on this perspective is often handled through TLS/SSL encryption of the transport layer within the TCP/IP stack.