Skip to main content

CISA alerts on Viber cloak mode TLS fingerprinting

Source Decision Insights Threat Desk Published March 5, 2026 Companies 3
Human View Machine View

3 companies named across 3 categories, one of 5 articles referencing Rakuten. Previous coverage: ABI Research publishes telco cloud-native platform ranking (Dec 2025).

Companies mentioned

Best suited for

Seniority
Architect
Job function
Cybersecurity / Information Security
Persona
Security Architect
Buyer role
Architect / Technical Evaluator
Decision stage
How to start
Adoption curve
Early Majority
Industry
Information Technology / Software & Services / IT Services / Internet Services & Infrastructure

Our classification, not the publisher's statement. Best suited for, not only for.

Rakuten Viber’s Proxy feature known as Cloak mode on Android and Windows relies on a static Transport Layer Security (TLS) ClientHello fingerprint, which allows that traffic to be identified and can result in network-level blocking and possible Denial of Service (DoS).

The issue is tracked as CVE-2025-13476 and appears in Rakuten Viber's Proxy (Cloak mode) on Android v25.7.2.0g and Windows v25.6.0.0–v25.8.1.0; it stems from a flaw in the TLS handshake implementation. The Cloak proxy mode ClientHello fingerprint is rigid and lacks extension diversity, making it identifiable by Deep Packet Inspection systems and undermining domain fronting.

The advisory states the Cloak-mode proxy traffic fails to hide the use of a proxy, and that the outgoing data is easily identifiable due to the rigid fingerprint and no longer appears to be normal browser TLS behavior. The document notes the issue compromises censorship circumvention capabilities, enables network-level blocking of Viber traffic in restrictive environments, and in specific instances may result in DoS; the user has no indication the proxy is not protecting their data.

For continued support, the advisory recommends implementing automatic updates for Viber Windows clients. The advisory lists the current Windows version as 27.3.0.0 and the Android mobile version as 27.2.0.0g.

The document includes vendor information and references, including Viber download and update pages, a Cloak project repository, and a Viber help article; it directs readers to reference the full report for more information and provides options to contact the advisory authors about the vulnerability and to provide a vendor statement.

Blog post, originally published by Laurie Tyzenhaus at kb.cert.org.

Mentions

Structured data (JSON-LD)

The schema.org markup this page publishes for search engines and AI agents, exactly as they read it.

[
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#website",
    "@type": "WebSite",
    "name": "Decision Insights",
    "potentialAction": {
      "@type": "SearchAction",
      "target": {
        "@type": "EntryPoint",
        "urlTemplate": "https://decisioninsights.ai/search/?q={search_term_string}&submit=1"
      }
    },
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    },
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#organization",
    "@type": "Organization",
    "contactPoint": {
      "@type": "ContactPoint",
      "contactType": "customer support",
      "email": "[email protected]"
    },
    "description": "Decision Insights is a Registry of technology companies, open source projects, and industry terms, built for people and for AI agents that need sourced, structured information.",
    "logo": {
      "@type": "ImageObject",
      "url": "https://wiretap-cdn-assets.nyc3.cdn.digitaloceanspaces.com/decision-insights/[email protected]"
    },
    "name": "Decision Insights",
    "parentOrganization": {
      "@type": "Organization",
      "name": "Wiretap Labs",
      "sameAs": [
        "https://www.linkedin.com/company/wiretap-labs",
        "https://www.crunchbase.com/organization/wiretap-labs"
      ],
      "url": "https://wiretaplabs.com"
    },
    "publishingPrinciples": "https://decisioninsights.ai/standards/",
    "sameAs": [
      "https://www.linkedin.com/company/decisioninsights"
    ],
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "itemListElement": [
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai",
        "name": "Decision Insights",
        "position": 1
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/records/",
        "name": "Records",
        "position": 2
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/cisa-alerts-on-viber-cloak-mode-tls-fingerprinting/",
        "name": "CISA alerts on Viber cloak mode TLS fingerprinting",
        "position": 3
      }
    ]
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/cisa-alerts-on-viber-cloak-mode-tls-fingerprinting/#blogposting",
    "@type": "BlogPosting",
    "about": {
      "@id": "https://decisioninsights.ai/registry/rakuten-mobile-network/#organization",
      "@type": "Organization",
      "mainEntityOfPage": "https://decisioninsights.ai/registry/rakuten-mobile-network/",
      "name": "Rakuten"
    },
    "articleSection": [
      "Cybersecurity"
    ],
    "audience": [
      {
        "@type": "Audience",
        "additionalType": "Seniority",
        "audienceType": "Architect"
      },
      {
        "@type": "Audience",
        "additionalType": "Job function",
        "audienceType": "Cybersecurity / Information Security"
      },
      {
        "@type": "Audience",
        "additionalType": "Persona",
        "audienceType": "Security Architect"
      },
      {
        "@type": "Audience",
        "additionalType": "Buyer role",
        "audienceType": "Architect / Technical Evaluator"
      },
      {
        "@type": "Audience",
        "additionalType": "Adoption curve",
        "audienceType": "Early Majority"
      },
      {
        "@type": "Audience",
        "additionalType": "Industry",
        "audienceType": "Information Technology / Software & Services / IT Services / Internet Services & Infrastructure"
      }
    ],
    "author": {
      "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
      "@type": "Person",
      "name": "Decision Insights Threat Desk",
      "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
    },
    "dateModified": "2026-08-27T10:32:22-06:00",
    "datePublished": "2026-03-05T10:45:08-07:00",
    "description": "Viber cloak mode uses a static TLS ClientHello that allows DPI detection and network-level blocking; affected versions include Android v25.7.2.0g and Windows v25.6.0.0–v25.8.1.0.",
    "headline": "CISA alerts on Viber cloak mode TLS fingerprinting",
    "isBasedOn": {
      "@type": "CreativeWork",
      "author": {
        "@type": "Person",
        "name": "Laurie Tyzenhaus"
      },
      "sourceOrganization": {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/",
        "name": "Department of Homeland Security"
      },
      "url": "https://kb.cert.org/vuls/id/772695"
    },
    "keywords": [
      "Denial of Service",
      "Proxy"
    ],
    "mainEntityOfPage": {
      "@id": "https://decisioninsights.ai/cisa-alerts-on-viber-cloak-mode-tls-fingerprinting/",
      "@type": "WebPage",
      "sdDatePublished": "2026-08-27",
      "sdPublisher": {
        "@id": "https://decisioninsights.ai/#organization"
      }
    },
    "mentions": [
      {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/",
        "name": "Cybersecurity and Infrastructure Security Agency (CISA)"
      },
      {
        "@id": "https://decisioninsights.ai/registry/deep/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/deep/",
        "name": "DEEP"
      },
      {
        "@id": "https://decisioninsights.ai/registry/rakuten-mobile-network/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/rakuten-mobile-network/",
        "name": "Rakuten"
      },
      {
        "@id": "https://decisioninsights.ai/projects/ietf-tls-protocol/#project",
        "@type": "SoftwareSourceCode",
        "mainEntityOfPage": "https://decisioninsights.ai/projects/ietf-tls-protocol/",
        "name": "IETF TLS Protocol"
      }
    ],
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    }
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
    "@type": "Person",
    "description": "CISA advisories, vendor security bulletins, and CVE disclosures, summarized into sourced briefs. Produced under our Standards & Methodology.",
    "name": "Decision Insights Threat Desk",
    "sameAs": [
      "https://www.linkedin.com/showcase/decisioninsights/"
    ],
    "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
  }
]

Is this your company? Get structured data for your own pages