:POLICE: A critical security vuln was fixed in Ditto Android that would allow an attacker to steal your nsec by getting you to tap an evil URL. :wisp_sad:

A new version has been released onto Zapstore and Google Play. UPDATE DITTO ANDROID IMMEDIATELY. :POLICE: :POLICE: :POLICE:

Ditto on web and iOS are unaffected. The issue only affects Android because it was a problem in the Android link handler. People using Amber are unaffected by nsec theft but should upgrade anyway because the attack is still arbitrary code injection via evil URL.

What does an evil URL look like? It contains JavaScript code inside of the URL. The path was not being escaped properly, so it could break out and run any script. The fixed version completely changes the way native code triggers UI navigation (event-driven) so we never inject JS code into the UI at all anymore.

Huge shout out and thank you to @calle for connecting me to the team behind https://v12.sh/ who discovered this vuln, and huge shout and and thank you to them for responsibly disclosing it to us. 🙏 They also discovered some other issues we patched in this release, but the evil URL is by far the worst.