AirMessage Direct Connection Vulnerable to Partitioning Oracle Attack

[vkrithika25]

We believe that AirMessage’s Direct Connection setup is vulnerable to the following attacks:

1. The direct connection method appears to use plain HTTP when traffic is observed on WireShark. Thus, it is possible for on-path network attackers to capture a packet and brute force decryption until they identify the server password. On obtaining the password, attackers can both capture and read plaintext user messages, as well as send messages to the server themselves.
2. Even in scenarios where the direct connection method uses HTTPS, the server is still vulnerable to a partitioning oracle attack. When the AirMessage server receives a message that fails to decrypt due to encryption with a key derived from an incorrect password, the server immediately terminates connection. Since there does not appear to be rate limiting on the server, an attacker can use this information to repeatedly send ciphertexts encrypted with keys derived from different passwords to the server, using the termination of the connection as a signal for whether or not the password is correct. This allows the attacker to brute-force guess the password and eventually impersonate the user by sending messages to the server themselves.