Security News > 2023 > August > Encryption Flaws in Popular Chinese Language App Put Users' Typed Data at Risk

A widely used Chinese language input app for Windows and Android has been found vulnerable to serious security flaws that could allow a malicious interloper to decipher the text typed by users.

The findings from the University of Toronto's Citizen Lab, which carried out an analysis of the encryption mechanism used in Tencent's Sogou Input Method, an app that has over 455 million monthly active users across Windows, Android, and iOS. The vulnerabilities are rooted in EncryptWall, the service's custom encryption system, allowing network eavesdroppers to extract the textual content and access sensitive data.

"The Windows and Android versions of Sogou Input Method contain vulnerabilities in this encryption system, including a vulnerability to a CBC padding oracle attack, which allow network eavesdroppers to recover the plaintext of encrypted network transmissions, revealing sensitive information including what users have typed," the researchers said.

CBC, short for cipher block chaining, is a mode of cryptographic operation in which each block of plaintext is XORed with the previous ciphertext block before being encrypted.

A threat actor could decrypt a message without actually knowing the encryption key.

Interestingly, the iOS version of Sogou Input Method was found to be secure against network eavesdropping, although it "Would have been the most vulnerable" due to a second defect in the EncryptWall implementation wherein the first half of the encryption key could be trivially recovered.

News URL

https://thehackernews.com/2023/08/encryption-flaws-in-popular-chinese.html