Knock-off Signal app Mike Waltz was caught using can be hacked in ‘15 to 20 minutes,' report says
The 'knock-off' Signal app Mike Waltz was caught using, which lacks security guarantees, can be hacked in '15 to 20 minutes,' according to a report.
Days after former National Security Adviser Mike Waltz was caught in photos using a Signal dupe called TeleMessage Signal, or TM SGNL, a hacker broke into the app and was able to access sensitive data. The app, which archives copies of all messages, unlike Signal, was infiltrated easily and within a matter of minutes all thanks to a basic misconfiguration in the app, the hacker told Wired.
'I would say the whole process took about 15 to 20 minutes,' the hacker said. 'It wasn't much effort at all.'
TeleMessage, which has since temporarily suspended its services, had a weak password system and a slew of other issues that allowed the hacker to easily infiltrate.
'I first looked at the admin panel secure.telemessage.com and noticed that they were hashing passwords to MD5 on the client side, something that negates the security benefits of hashing passwords, as the hash effectively becomes the password,' the hacker said.
Hashing is a security measure that transforms plain-text passwords into a seemingly random string of characters, making it difficult to determine the original password. However, TeleMessage used MD5, an inadequate version of the algorithms used to hash passwords, according to Wired.
TeleMessage was also programmed with JSP, an antiquated program to create web apps in Java, which made the hacker realize 'their security must be poor.'
The hacker then utilized Feroxbuster, which locates publicly available resources on a website, to find a vulnerable URL to hack. They were then led to a Java heap dump – a snapshot of the server's memory the moment they loaded the URL – and discovered usernames and passwords of random accounts.
The hacker tried logging into the app with a random pair of credentials they had just gained access to – and eventually hacked into an account with an email address associated with US Customs and Border Protection.
CBP confirmed to Wired that it was a TeleMessage customer.
The hacker was then able to read plaintext chat logs, including internal conversations from Coinbase, a popular crypto trading platform.
Within 15 to 20 minutes, the hacker said they were able to compromise CBP and Coinbase, according to the report.
According to the report, the app uploaded unencrypted messages to archive.telemessage.com before forwarding the messages to the customer's intended destination. This goes against TeleMessage's claims that the app uses 'end-to-end encryption from the mobile phone through to the corporate archive,' according to the report.
Additionally, according to the report, if anyone had loaded the heap dump URL as Mike Waltz was texting on the app, they would have been able to gain access to his encrypted Signal messages as well.
Waltz was Trump's National Security Adviser before being removed from his post and tapped to be the U.S. ambassador to the United Nations.
The shakeup happened after Waltz accidentally added Jeffrey Goldberg, the editor-in-chief of The Atlantic, to a Signal group chat where top Trump officials were discussing imminent U.S. military strikes on Yemen.
Goldberg then reported on what was supposed to be a secret dialogue between officials, including Defense Secretary Pete Hegseth and Vice President JD Vance, causing a scandal for the Trump administration.
Secretary of State Marco Rubio is Trump's acting National Security Adviser until he names an official replacement.
Try Our AI Features
Explore what Daily8 AI can do for you:
Comments
No comments yet...
Related Articles
Reuters
an hour ago
- Reuters
Tesla's public robotaxi rides to start on June 22, tentatively, CEO Musk says
SAN FRANCISCO, June 10 (Reuters) - Tesla (TSLA.O), opens new tab tentatively plans to begin offering rides on its self-driving robotaxis to the public on June 22, CEO Elon Musk said on Tuesday in a post on X.
Daily Mail
an hour ago
- Daily Mail
California's First Lady shrugs off riots crisis to shop in Beverly Hills
Her husband is fighting for his life politically for the second time this year while another crisis grips their state. But California's First Lady Jennifer Siebel Newsom shrugged off the chaos on Monday as she stepped out in under-siege Los Angeles. Jennifer, 50, was spotted at One Beverly Hills - a luxurious complex of wellness centers and spas in the city's most exclusive zip code. She was dressed the part in a pair of $500 Common Project sneakers and a $2,500 Goyard tote bag, her bodyguard trailing behind her as she offered a coy smile. Siebel Newsom, a documentary filmmaker, seemed upbeat and calm. At the same time, Marines were marching towards Los Angeles under orders from President Trump while businesses recovered from looters. The unrest took a dark turn on Tuesday morning with the discovery of a body outside one of the trashed stores. Newsom's representatives angrily denied any suggestion that she was luxuriating amid the chaos, telling Daily Mail: 'The First Partner didn't have a spa treatment yesterday, but she does have a prior skin cancer diagnosis and was picking up skin care products on her personal time.' Jennifer previously shared her battle with skin cancer in 2023. Her husband, meanwhile, continues to do battle with the president and his supporters, insisting he has the situation under control. Both he and LA Mayor Karen Bass have demanded that Trump withdraw military troops from the streets. The protests erupted on Friday when anti-ICE demonstrators seized on a number of police investigations unfolding around the city. California First Lady Jennifer Newsom was spotted leaving the One Beverly Hills complex in LA on Monday President Donald Trump has activated 4,000 National Guard troops and deployed hundreds of US Marines to the city to quell protests despite objections from Newsom and other local leaders. Newsom said that Trump's deployment of National Guard troops has only inflamed the situation and made it more difficult for local law enforcement to respond to the demonstrations. Trump claims the city would have been 'completely obliterated' if he had not deployed the Guard. The chaos began on Friday when anti-ICE protesters seized on a handful of police raids across the city, taking to the streets to burn cars and march against what they say are unfair deportations. Trump claims the city would have been 'completely obliterated' if he had not deployed the Guard. Jennifer Newsom, carrying a $2,650 Goyard Saint Louis bag and wearing $485 sneakers, sported a soft smile at the One Beverly Hills plaza Governor Gavin Newsom taunted Trump and his border czar, daring them to 'arrest him' and insisting he has the riots 'under control' Protesters threw rocks and other objects at officers and vehicles, blocked a major freeway and looted downtown businesses. Police responded by firing projectiles like pepper balls, as well as flash bang grenades and tear gas. Hundreds of demonstrators gathered again on Monday outside a federal detention center in downtown LA where immigrants have been held. They chanted 'free them all' as they waved Mexican and Central American flags. National Guard forces formed a human barricade to keep people out of the building, and police dispersed the crowd using gas canisters and arrested some protesters. At dusk, officers had running confrontations with protesters who had scattered into the Little Tokyo section of the city. As people watched from apartment patios above street level and as tourists huddled inside hotels, a large contingent of LAPD and officers and sheriff's deputies fired several flash bangs that boomed through side streets along with tear gas. Los Angeles Mayor Karen Bass told KABC that more than 100 people had been arrested on Monday but that the majority of protesters were nonviolent. Newsom with wife, Jennifer Siebel Newsom. Her office insisted she was picking up skincare on her 'personal time' Anti-ICE demonstrators clash with police near the federal building and detention center in LA on Monday as protests over immigration raids continue for a fourth day US Customs and Border Patrol agents and the California National Guard protect the federal building in Los Angeles as protesters rally Monday for the fourth day in a row Fireworks explode around police officers in riot gear during a protest in response to federal immigration operations in the Little Tokyo neighborhood of downtown LA on Monday Trump's decision to mobilize 700 Marines based in Southern California escalated his confrontation with Newsom, who filed a lawsuit on Monday asserting that Trump's deployment of Guard troops without the governor's consent was illegal. The Guard deployment was the first time in decades that a president activated the Guard absent a request from a sitting governor. While the Marines are only tasked with guarding federal property temporarily until the full contingent of 4,000 Guard troops arrives, the use of active military to respond to civil disturbances is extremely rare. 'This isn't about public safety,' Newsom wrote on X on Monday. 'It's about stroking a dangerous President's ego.' The top Democrat on the Senate Armed Services Committee, Senator Jack Reed, said he was 'gravely troubled' by Trump's deployment of active-duty Marines. 'Since our nation's founding, the American people have been perfectly clear: we do not want the military conducting law enforcement on US soil,' he said. Trump has justified his decision to deploy active military troops to LA by describing the protests as a violent occupation of the city, a characterization that Newsom and Bass have said is grossly exaggerated. The president, in a Tuesday morning post on his Truth Social platform, claimed LA would be 'burning to the ground right now' if he had not deployed troops to the city. Protests spread to neighboring Orange County on Monday night after immigration raids there, with demonstrators gathering at the Santa Ana Federal building, according to local officials and news reports. Protests also sprang up in at least nine other US cities on Monday, including New York, Philadelphia and San Francisco, according to local news reports. In Austin, Texas, police fired non-lethal munitions and detained several people as they clashed with a crowd of several hundred protesters. Trump officials have branded the protests as lawless and blamed state and local Democrats for protecting undocumented immigrants with sanctuary cities. Meanwhile. US Homeland Security Secretary Kristi Noem pledged on Monday to carry out more operations to round up suspected immigration violators.
Daily Mail
an hour ago
- Daily Mail
Democrat LaMonica McIver is indicted on federal charges over brawl outside Newark ICE detention facility
New Jersey Democrat LaMonica McIver has been indicted over a brawl with Immigrations and Customs Enforcement agents outside a Newark detention facility. The Congresswoman was slapped with federal charges on Tuesday alleging she impeded and interfered with immigration officers as they sought to arrest Newark Mayor Ras Baraka on May 9. The duo were part of a group trying to conduct a congressional oversight visit at the facility amid increased ICE activity, but a brawl broke out when they were refused. Acting US Attorney for New Jersey and Trump ally Alina Habba announced the grand jury indictment in a post on X. 'While people are free to express their views for or against particular policies, they must not do so in a manner that endangers law enforcement and the communities those officers serve,' Habba wrote. McIver had been charged in a complaint by Habba last month with two assault charges stemming from the May 9 visit to Newark's Delaney Hall - a 1,000-bed, privately owned facility that Immigration and Customs Enforcement uses as a detention center. McIver disputed the allegations as baseless and defended her presence at the facility as part of her authorized role as a member of Congress. Her lawyer, former US Attorney for New Jersey Paul Fishman, said in a statement that they would challenge the allegations 'head-on' in court. 'The legal process will expose this prosecution for what it truly is -- political retaliation against a dedicated public servant who refuses to shy away from her oversight responsibilities,' Fishman said. Habba said two of the counts carry a maximum sentence of up to eight years in prison. A third has a maximum sentence of one year. She characterized the charges as 'forcibly impeding and interfering with federal law enforcement officers.' The prosecution of McIver is a rare federal criminal case against a sitting member of Congress for allegations other than fraud or corruption. Habba said when announcing the charges that she had made persistent efforts to find a resolution to the matter which would not result in criminal charges, but that McIver had declined. McIver issued a statement railing against the charges at the time, describing them as 'purely political. 'They mischaracterize and distort my actions, and are meant to criminalize and deter legislative oversight,' she said. 'Our visit should have been peaceful and short. Instead, ICE agents created an unnecessary and unsafe confrontation.' At the same visit that resulted in McIver's charges, Baraka was arrested on a trespassing charge, which was later dropped. Baraka is suing Habba over what he said was a malicious prosecution. A nearly two-minute clip released by the Homeland Security Department shows McIver in a tightly packed group of people and officers. At one point, her left elbow and then her right elbow push into an officer wearing a dark face covering and an olive green uniform emblazoned with the word 'Police' on it. It isn't clear from police bodycam video whether that contact was intentional, incidental or a result of jostling in the chaotic scene. The complaint says she 'slammed' her forearm into an agent then tried to restrain the agent by grabbing him. New Jersey Reps. Bonnie Watson Coleman and Rob Menendez had joined McIver at the detention center that day. They and Democrats have criticized the arrest and disputed the charges as well. By law, members of Congress are authorized to go into federal immigration facilities as part of their oversight powers, even without notice. Congress passed a 2019 appropriations bill that spelled out the authority. McIver, 38, first came to Congress in September in a special election after the death of Rep. Donald Payne Jr. left a vacancy in the 10th District. She was then elected to a full term in November. A Newark native, she served as the president of the Newark City Council from 2022 to 2024 and worked in the city´s public schools before that.
