A widely used Chinese language input app for Windows and Android has been found vulnerable to serious security flaws that could allow a malicious interloper to decipher the text typed by users.
The findings from the University of Toronto's Citizen Lab, which carried out an analysis of the encryption mechanism used in Tencent's Sogou Input Method, an app that has over 455 million monthly active users across Windows, Android, and iOS.
The vulnerabilities are rooted in EncryptWall, the service's custom encryption system, allowing network eavesdroppers to extract the textual content and access sensitive data.
"The Windows and Android versions of Sogou Input Method contain vulnerabilities in this encryption system, including a vulnerability to a CBC padding oracle attack, which allow network eavesdroppers to recover the plaintext of encrypted network transmissions, revealing sensitive information including what users have typed," the researchers said.
CBC, short for cipher block chaining, is a mode of cryptographic operation in which each block of plaintext is XORed with the previous ciphertext block before being encrypted.
Given that a block cipher works on fixed size plaintext blocks, a padding oracle attack could be used to leak data about whether the received ciphertext, when decrypted, has a valid padding. In doing so, a threat actor could decrypt a message without actually knowing the encryption key.
Interestingly, the iOS version of Sogou Input Method was found to be secure against network eavesdropping, although it "would have been the most vulnerable" due to a second defect in the EncryptWall implementation wherein the first half of the encryption key could be trivially recovered.
It's worth noting that the scope of the issues are not limited to Chinese writers in China. Statistics from SimilarWeb show that visits to the app's website – shurufa.sogou[.]com – also come from the U.S., Taiwan, Hong Kong, and Japan.
Following responsible disclosure in May and June 2023, the problem has been addressed by Tencent in version 13.7 (Windows), 11.26 (Android), and 11.25 (iOS) as of late last month.
"This vulnerability could have been easily avoided by, instead of using 'homebrew' cryptography, adopting TLS, a common and mature cryptographic protocol with ubiquitous availability and up-to-date support," researchers Jeffrey Knockel, Zoë Reichert, and Mona Wang said.
"While no cryptographic protocol is perfect, TLS implementations had already ameliorated vulnerability to CBC padding oracle attacks in 2003."
The development coincides with the disclosure of two zero-day flaws, CVE-2023-33241 and CVE-2023-33242 (aka BitForge), in the implementation of cryptographic multi-party computation (MPC) protocols such as GG18, GG20, and Lindell17 2PC used in popular cryptocurrency wallets that, if exploited, could allow "attackers and malicious insiders to drain funds" without their knowledge.
