Randshell

Meshtastic firmware, starting with version 2.5, implemented asymmetric encryption (PKI) for direct messages. However, when the `pki encrypted` flag is absent, the firmware reverts to legacy AES-256-CTR channel encryption without notifying the user. This creates a potential downgrade attack where an adversary with knowledge of a shared channel key can inject spoofed direct messages that appear as if they are PKI encrypted. User applications, including the Web app, iOS/Android app, and SDK-based applications, lack the ability to distinguish between PKI-encrypted and legacy-encrypted direct messages, undermining the security benefits of the PKI implementation. The `pki encrypted` flag is a parameter used to indicate whether a direct message has been encrypted with PKI.

Name of the Vulnerable Software and Affected Versions: Meshtastic-Android versions prior to 2.5.21 Description: The issue allows an attacker to send an unencrypted direct message to a victim, impersonating any other node of the mesh. This message will be displayed in the same chat that the victim normally communicates with the other node, appearing as if it is using PKC (Public Key Cryptography), when in fact it is not. As a result, the victim may be provided with a false sense of security due to the green padlock displayed when using PKC, and they will read the attacker's message as legitimate. Recommendations: For versions prior to 2.5.21, update to version 2.5.21 to resolve the issue. As a temporary workaround, consider implementing stricter control on whether a message has been received using PKC or using the shared Meshtastic channel key. Consider using an explicit indicator, such as the yellow half-open padlock displayed when in HAM mode, instead of showing no green padlock icon in the chat with no PKC.