{"id":42823,"date":"2021-09-13T20:22:10","date_gmt":"2021-09-13T20:22:10","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/how-a-glitch-in-the-matrix-led-to-apps-potentially-exposing-encrypted-chats\/"},"modified":"2021-09-13T20:22:10","modified_gmt":"2021-09-13T20:22:10","slug":"how-a-glitch-in-the-matrix-led-to-apps-potentially-exposing-encrypted-chats","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/how-a-glitch-in-the-matrix-led-to-apps-potentially-exposing-encrypted-chats\/","title":{"rendered":"How a glitch in the Matrix led to apps potentially exposing encrypted chats"},"content":{"rendered":"

The Matrix.org Foundation, which oversees the Matrix decentralized communication protocol, said on Monday multiple Matrix clients and libraries contain a vulnerability that can potentially be abused to expose encrypted messages.<\/p>\n

The organization said a blunder in an implementation of the Matrix key sharing scheme \u2013 designed to allow a user’s newly logged-in device to obtain the keys to decrypt old messages \u2013 led to the creation of client code that fails to adequately verify device identity. As a result, an attacker could fetch a Matrix client user’s keys.<\/p>\n

Specifically, a paragraph in Matrix E2EE (end-to-end encryption) Implementation Guide, which described the desired key handling routine, was followed in the creation of Matrix’s original matrix-js-sdk<\/code> code. According to the foundation, this SDK “did not sufficiently verify the identity of the device requesting the keyshare,” and this oversight made its way into other libraries and Matrix chat clients.<\/p>\n