Researchers at Royal Holloway have found serious vulnerabilities in the messaging app, Bridgefy which could have significant consequences for its users.
The messaging app has been advertised for use by people across the world during large-scale protests when normal forms of communication are down, for example due to a government mandated internet shutdown. The developers of the app reported increased uptake from several sites of protest such as Hong Kong, India, Iran, Lebanon, Zimbabwe, and the US.
The academics from the Information Security Group (ISG) at Royal Holloway found that Bridgefy did not design and implement their application with security in mind and have proposed that Bridgefy should make use of an established cryptographic library.
The main flaws found by the researchers in the ISG, Lenka Mareková, Jorge Blasco, Rikke Bjerg Jensen and Martin R. Albrecht, were that Bridgefy did not implement some necessary cryptographic protections and some cryptographic protections were implemented incorrectly.
They also found that the protocol wasn’t designed in a way to minimise information leaking, and its robustness against maliciously crafted messages was weak.
The key feature of Bridgefy is that it exchanges data using Bluetooth when an internet connection is not available. The application can send the following kinds of messages:
- one-to-one messages between two parties
- sent over the internet if both parties are online
- sent directly via Bluetooth if the parties are in physical range, or
- sent over the Bluetooth mesh network, and
- Bluetooth broadcast messages that anyone can read in a special “Broadcast mode” room.
Professor Martin Albrecht, from ISG at Royal Holloway, said: “We disclosed the vulnerabilities we found to Bridgefy developers in April this year. They confirmed these vulnerabilities soon after. Following up, the Bridgefy team began to inform their users that they should not expect confidentiality guarantees from the current version of the application.
“In June, they told us they are implementing a switch to the Signal protocol. This would provide cryptographic assurances and would fix many, but not all of the issues we found.”
This research is part of a larger interdisciplinary project between social scientists, systems security researchers and cryptographers on information security needs and requirements in protests. It showcases the integration of different disciplines studying information security as a key feature of the Information Security Group and its Centre for Doctoral Training in Cyber Security for the Everyday.
