Signal Vulnerability Allow Audio and Possibly Video to Continue After Hanging Up

A vulnerability in the secure messenger Signal allows an attacker to cause a call to not properly hang up when you hang up on your end, allowing audio and possibly video to continue being transmitted.

The vulnerability earns a CVSS 9.3 severity rating out of a possible 10, meaning it's considered critical.

The issue lies in RingRTC versions before 2.72.0 and versions of Signal on Android, iOS, and Desktop are affected. Versions of RingRTC after 2.72.0 fix the issue. Update your client as soon as possible to get the fixed version.

The writeup on GitHub by Imahian explains the root cause:

A local hang-up is not a kill switch: it is just one more event placed at the back of the call's finite-state-machine event queue. The remote peer is trusted with that queue — there is no rate limit on peer-originated events and no priority lane for hang-up. Flood the queue with junk and the hang-up waits behind attacker noise forever, so the call (microphone, possibly camera) is never torn down.

They provide a proof-of-concept for the attack written in Python so you can test it out yourself if you're curious how it works, although it's not an actual working exploit, just an offline demonstration. There's also a video explainer as well:

On Android and iOS, you can see indicators at the top of your screen showing if your microphone and camera are active. Make sure to check those disappear once you hang up your Signal call. If they don't, you can revoke Signal's access to the camera and microphone on iOS and Android in the settings.

Windows will show a notification when the camera turns on or off (unless your computer has a built-in camera indicator light) and a microphone icon will appear in the desktop tray if an app is using the microphone. You can't toggle all apps individually, but you can toggle the camera or microphone off for all apps at once in the settings.

macOS has a physical camera indicator or a software one. You can toggle camera and microphone access for each app.

Linux may or may not have an onscreen indicator, but your computer might have its own built-in camera indicator that you can check to make sure the camera isn't on.