Nothing Chats application, which was released by Nothing at the beginning of last week, has been temporarily removed from the Google Play Store by the company. A security vulnerability has been detected in the Nothing Chat application, which was removed from the Google Play Store due to a software error. Here are the details…
Nothing Chat has been removed from Google Play Store due to security vulnerability
According to extensive technical analysis by Rida F’kih and Twitter users @batuhan and @1ConanEdogowa, messages transmitted through its servers are not end-to-end encrypted as claimed by Nothing’s service provider Sunbird.
It is necessary to register with the Nothing Chats application with an Apple ID. The company, which keeps user and message information on Sunbird servers, does not encrypt sent messages end-to-end as claimed. Additionally, as discovered by people testing the application, the JSON Web Tokens, or JWTs, generated by the service are sent unencrypted again without SSL to another Sunbird server.
iMessage, get up, your elder is here! Nothing Chats has been announced!
Nothing Chats, which brings iMessage compatibility to Android phones, was announced with a video on the company’s official YouTube channel.
In Nothing Chat, messages are stored on Sunbird servers after being encrypted, which gives an attacker a chance to access them before the user does. The team identified the vulnerability and demonstrated it by sending several messages between two devices and capturing the JWT.
According to the published report, malicious people can intercept their own messages when they send messages between two devices by writing a few lines of code. It should be noted that they can do this with any of the messaging devices connected to the same network.
What do you think about this issue? You can share your ideas with us in the comments section.