Kota Urushigaki

Practical Attacks on a Decentralized Secure Messenger Session

USENIX WOOT ’26Kota Urushigaki, Hayato Kimura, Atsushi Tanaka, Takanori Isobe

Session is a decentralized, anonymous end-to-end encrypted messenger with more than a million downloads on Google Play alone. In late 2020 it moved away from the Signal Protocol to its own design, which a 2021 Quarkslab audit covered only partly because the switch came near the audit’s end. Working from the shipped implementation, I analyzed its 1-to-1 and closed-group messaging and found two design flaws: public keys are never mutually authenticated, and messages are not cryptographically bound to monotonic counters.

From these I built three new practical attacks, usable by a malicious storage node or an unprivileged insider:

• impersonation by substituting a contact’s public key on first contact,
• forging message timestamps to reorder a conversation,
• silently dropping or replaying messages.

The paper also proposes concrete mitigations. Its artifact received the USENIX Artifact Available badge.

I disclosed all three attacks to the Session team. In late April 2026 they accepted most of our findings, and classified the replay attack as unexploitable because an incidental database configuration currently blocks it, rather than a designed security boundary. As of July 2026, fixes were in progress.

Paper (PDF) ePrint Slides Artifact

Presented at USENIX WOOT ’26, Baltimore, August 2026

Next: reverse engineering proprietary protocols

Master’s research, from April 2027

Many deployed systems run cryptographic protocols that were never published. In my master’s research I plan to recover their design from the implementation, model it formally in Tamarin, and look for attacks the vendors’ own analysis missed.

Three practical attacks on the Session messenger

October 2026 · Blog post

A plain-language walkthrough of our WOOT ’26 paper: how a one-way key check and a missing message counter lead to impersonation, timestamp forgery, and message dropping and replay, with diagrams and the disclosure timeline.

session-woot

Docker · Python · Swift (iOS) · Repository

A fully local, reproducible testbed for all three attacks. A Docker Compose stack runs five honest storage nodes and one malicious node whose attack hook can be switched at runtime; three patched iOS clients play sender, receiver and attacker; and a single command-line tool brings up the network and drives each attack.

Master’s in Information Science, Graduate School of Information Science and Technology, The University of Osaka

From April 2027

B.Eng. in Computer Science, School of Engineering Science, The University of Osaka

April 2022 – March 2026 · Isobe Laboratory

Exchange student, Technical University of Munich

Informatics · October 2024 – August 2025

Specially Appointed Researcher, Isobe Laboratory, The University of Osaka

April 2026 – present

Continuing my undergraduate research on deployed cryptographic protocols, combining formal modeling with black-box and white-box analysis of real implementations to find design flaws.

Cloud security engineer (part-time), Novagrid Co., Ltd.

April 2026 – present

Run and harden the multi-cloud infrastructure on Microsoft Azure and Google Cloud for an early-stage startup of about 50 people, as the sole engineer responsible.

Σ Global Leader Award of Engineering Science, The University of Osaka

March 2026

Bronze prize, Robust Democracy main track, ETHTokyo 2024 hackathon

August 2024

ZK Treasure Hunt: a multiplayer treasure hunt in which a prover answers players’ guesses with zero-knowledge proofs, so the treasure’s location is never revealed.

PSE Core Program Japan, Ethereum Foundation

April – August 2024

Training in zero-knowledge proof systems, circuit development and applied cryptography, run by Privacy & Scaling Explorations.

KEYENCE Foundation Scholarship

August 2023