Signal Calls Could Keep Going After You Hang Up #signal #security #programming
Read the Portuguese translation →
Author: Better Stack · Watch on YouTube
Video authored by the channel shown, not by IANIA; all rights belong to the creator. Transcript and summary generated automatically; the original-language content is preserved.
Original language: English
Original video: Signal Calls Could Keep Going After You Hang Up #signal #security #programming · Channel: Better Stack · 01:03 · Watch on YouTube
Topics: Cybersecurity and software security, Software engineering with AI, Privacy and data protection
Summary
Section titled “Summary”A critical bug in RingRTC, the open-source library Signal uses for voice and video calls, could let someone already on a call prevent it from ending properly after the other person hung up. The issue could leave audio—and possibly video—active, but did not affect messages, accounts, or encryption, and there is no evidence it was exploited. Signal fixed the bug on September 4, rolled out the fix to Android, iPhone, and desktop over the following weeks, and the CVE became public on October 20. The video also recalls similar calling bugs in FaceTime, Signal, Google Duo, and Facebook Messenger.
Key points
Section titled “Key points”- The bug was in RingRTC, which Signal uses for voice and video calls.
- It was rated 9.3 and described as critical.
- Someone already on a call could flood its internal queue and prevent the call from terminating properly.
- Audio could remain active after the user pressed the hang-up button, and video might also continue.
- Signal fixed the issue on September 4 and later rolled out the fix to Android, iPhone, and desktop.
- The CVE was made public on October 20.
- The issue did not affect messages, accounts, or encryption, and there was no evidence it had been used.
- The video cites earlier calling bugs in FaceTime, Signal, Google Duo, and Facebook Messenger.
Chapters
Section titled “Chapters”| Start | Chapter | Summary |
|---|---|---|
| 00:00 | The Signal call hang-up bug | A critical RingRTC bug could let someone already on a Signal call prevent it from ending when the other person hung up. |
| 00:30 | The fix and the scope of the issue | Signal fixed and rolled out the issue, which affected call termination but not messages, accounts, or encryption. |
| 01:03 | Similar bugs in other calling apps | The video recalls earlier call-connection bugs and concludes that making calls end reliably can be difficult. |
Quotes
Section titled “Quotes”hanging up might not have actually ended the call. — 00:00
This is a real bug and it’s rated 9.3, so critical — 00:00
ensure calls terminate completely in corner cases — 00:30
there’s actually no evidence that anyone used this. — 00:30
the hardest part of building a calling app might actually be making the call end. — 01:03
Concepts and entities
Section titled “Concepts and entities”RingRTC, Signal, CVE, FaceTime, Project Zero, Google Duo, Facebook Messenger
Full transcript (original language)
Section titled “Full transcript (original language)”00:00 If you were on a signal call with the wrong person, hanging up might not have actually ended the call. This is a real bug and it’s rated 9.3, so critical, and it’s in RingRTC, which is the open source library that Signal uses for its voice and video calls. The official description says someone on the call could flood the call’s internal queue, which stops your hang up from tearing the call down along with the audio and perhaps the video. So, you press that red button thinking you’re gone, but the other person can still hear you and maybe even see you. Signal actually fixed this back on the 4th of September.
00:30 The fix literally says ensure calls terminate completely in corner cases, and in the change log it’s just one bullet point with nothing saying it’s a security fix. This rolled out to Android, iPhone, and desktop over the next few weeks, and the CVE was only made public on the 20th of October. It is worth noting that only someone you’re already on call with could do this, so it’s not a random stranger listening in, and your messages, your account, and encryption weren’t touched, and there’s actually no evidence that anyone used this. Signal’s not the only one that’s been hit by this type of bug before as well. In 2019, FaceTime had a bug where a caller could hear you before you even
01:03 picked up, and Apple had to switch group FaceTimes off until this issue was fixed. That same year, Google’s Project Zero found a caller could force a Signal call on Android to connect, and when they looked wider, they found the same kind of bug in Google Duo and Facebook Messenger, too. So, it turns out the hardest part of building a calling app might actually be making the call end. Anyway, update Signal and subscribe for more AI and dev news every week.