LINE Messaging Bugs Open Asian Users to Cyber Espionage

LINE, a widely used encrypted messaging platform in East Asia, has been found to enable three main attack buckets: message replay, plaintext and URL preview leakage, and impersonation attacks, due to a leaky custom end-to-end protocol. The security analysis, conducted by researchers Thomas Mogensen and Diego De Freitas Aranha from Aarhus University, will be presented at Black Hat Europe in early December.

They demonstrated that a malicious server can replay encrypted messages, expose what users type through sticker and emoji delivery or URL previews, and forge messages from other participants within a chat, provided the attacker can operate a MiTM position via a compromised server. The implications are particularly acute given LINE’s role as a “super application” in the region, handling activities from banking to government services, with the potential for state-sponsored threats to exploit the weaknesses.

There are no fixes on the horizon, and LINE acknowledged the vulnerabilities but offered limited mitigation, leaving users to rely on workarounds such as changing default settings. According to Aarhus University, the issues persist in Letter Sealing v2, echoing earlier findings from similar messaging apps.