The open-source IM project warned that encrypted group chats may have been easier to crack for seven months The founder of an eavesdropping-resistant instant messaging application called Cryptocat has apologized over a now-fixed bug that made some types of messages more vulnerable to snooping.Cryptocat, which runs inside a web browser, is an open-source application intended to provide users with a high degree of security by using encryption to scramble messages. But Cryptocat warns that users should still be very cautious with communications and not to trust their life with the application.The vulnerability, found by Steve Thomas, affected group chats and not private conversations, said Nadim Kobeissi, in an interview from Germany Friday. The encryption keys used to encode those conversations were too short, which in theory made it easier for an attacker to decrypt and read conversations.The error was the result of an oversight spotted by Thomas, Kobeissi said. The encrypted conversations were still carried over SSL (Secure Sockets Layers), another overlay of encryption. But if an attacker broke the SSL encryption and had the underlying encrypted chats, “it would be significantly easier to crack” using brute-force techniques, he said. The bug was fixed in Cryptocat versions 2.0 and up about a month ago after Thomas notified the project. The vulnerability persisted for about seven months between September 2012 and April.Although Cryptocat noted the patch in its changelog, Kobeissi wrote a detailed blog post on Thursday explaining the issue after Thomas published a sharp critique. “This is a really difficult situation,” Kobeissi said. “I am not a person who will gloss over this kind of bug for absolutely no reason just to maintain the image of the project.”The bug was completely unacceptable, but it is common for errors to be revealed in open-source projects, he said. Kobeissi said he gave Thomas a US$250 reward out of his own pocket even though Cryptocat has no formal bug bounty program.“I wanted to be on the record that he was paid for his effort,” Kobeissi said.Cryptocat has seen surging interest since the U.S. National Security Agency’s surveillance program was detailed by whistleblower Edward Snowden. Kobeissi said Cryptocat saw 65,000 new users in just a month since the revelations were published.Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk Related content feature Top cybersecurity M&A deals for 2023 Fears of recession, rising interest rates, mass tech layoffs, and conservative spending trends are likely to make dealmakers cautious, but an ever-increasing need to defend against bigger and faster attacks will likely keep M&A activity steady in By CSO Staff Sep 22, 2023 24 mins Mergers and Acquisitions Mergers and Acquisitions Mergers and Acquisitions brandpost Unmasking ransomware threat clusters: Why it matters to defenders Similar patterns of behavior among ransomware treat groups can help security teams better understand and prepare for attacks By Joan Goodchild Sep 21, 2023 3 mins Cybercrime news analysis China’s offensive cyber operations support “soft power” agenda in Africa Researchers track Chinese cyber espionage intrusions targeting African industrial sectors. By Michael Hill Sep 21, 2023 5 mins Advanced Persistent Threats Cyberattacks Critical Infrastructure brandpost Proactive OT security requires visibility + prevention You cannot protect your operation by simply watching and waiting. It is essential to have a defense-in-depth approach. By Austen Byers Sep 21, 2023 4 mins Security Podcasts Videos Resources Events SUBSCRIBE TO OUR NEWSLETTER From our editors straight to your inbox Get started by entering your email address below. Please enter a valid email address Subscribe