An encrypted messaging app reportedly favored by members of Donald Trump's administration may not be so secure.
As reported by CyberScoop, researchers at security firm IOActive discovered multiple critical vulnerabilities in the Confide app.
For the uninitiated, Confide is billed as a super-secure messenger. According to its website, the app uses "military-grade end-to-end encryption to keep your messages safe." The app also promises to leave no trace of your conversations behind: "messages disappear forever after they are read once, making them as private and secure as the spoken word," the makers of Confide write. It also prevents recipients from taking screenshots of messages.
The only problem: IOActive last month uncovered "numerous security issues" in the app, which could have allowed an attacker to impersonate a Confide user, sneakily sleuth people's contact details, alter the contents of a message or attachment in transit, or "become an intermediary in a conversation and decrypt messages."
IOActive reported the flaws to Confide and the company has patched all the holes. But these flaws may have "existed for years," according to CyberScoop. The app has been around since 2014, and this is the first time Confide has allowed third-party researchers to scour its code for bugs, the report notes.
In a statement, Confide reiterated that the issues have now been resolved and said it has no record of them ever being exploited maliciously.
"Our security team is continuously monitoring our systems to protect our users' integrity, and we were able to detect anomalous behavior and remediate many of the issues during IOActive's testing in real time," the company wrote. "Privacy and security is always an ongoing process. As issues arise, we remain committed to addressing them quickly and efficiently, as we have done in this and every instance."