Knock-off Signal app Mike Waltz was caught using can be hacked in ‘15 to 20 minutes,' report says
The 'knock-off' Signal app Mike Waltz was caught using, which lacks security guarantees, can be hacked in '15 to 20 minutes,' according to a report.
Days after former National Security Adviser Mike Waltz was caught in photos using a Signal dupe called TeleMessage Signal, or TM SGNL, a hacker broke into the app and was able to access sensitive data. The app, which archives copies of all messages, unlike Signal, was infiltrated easily and within a matter of minutes all thanks to a basic misconfiguration in the app, the hacker told Wired.
'I would say the whole process took about 15 to 20 minutes,' the hacker said. 'It wasn't much effort at all.'
TeleMessage, which has since temporarily suspended its services, had a weak password system and a slew of other issues that allowed the hacker to easily infiltrate.
'I first looked at the admin panel secure.telemessage.com and noticed that they were hashing passwords to MD5 on the client side, something that negates the security benefits of hashing passwords, as the hash effectively becomes the password,' the hacker said.
Hashing is a security measure that transforms plain-text passwords into a seemingly random string of characters, making it difficult to determine the original password. However, TeleMessage used MD5, an inadequate version of the algorithms used to hash passwords, according to Wired.
TeleMessage was also programmed with JSP, an antiquated program to create web apps in Java, which made the hacker realize 'their security must be poor.'
The hacker then utilized Feroxbuster, which locates publicly available resources on a website, to find a vulnerable URL to hack. They were then led to a Java heap dump – a snapshot of the server's memory the moment they loaded the URL – and discovered usernames and passwords of random accounts.
The hacker tried logging into the app with a random pair of credentials they had just gained access to – and eventually hacked into an account with an email address associated with US Customs and Border Protection.
CBP confirmed to Wired that it was a TeleMessage customer.
The hacker was then able to read plaintext chat logs, including internal conversations from Coinbase, a popular crypto trading platform.
Within 15 to 20 minutes, the hacker said they were able to compromise CBP and Coinbase, according to the report.
According to the report, the app uploaded unencrypted messages to archive.telemessage.com before forwarding the messages to the customer's intended destination. This goes against TeleMessage's claims that the app uses 'end-to-end encryption from the mobile phone through to the corporate archive,' according to the report.
Additionally, according to the report, if anyone had loaded the heap dump URL as Mike Waltz was texting on the app, they would have been able to gain access to his encrypted Signal messages as well.
Waltz was Trump's National Security Adviser before being removed from his post and tapped to be the U.S. ambassador to the United Nations.
The shakeup happened after Waltz accidentally added Jeffrey Goldberg, the editor-in-chief of The Atlantic, to a Signal group chat where top Trump officials were discussing imminent U.S. military strikes on Yemen.
Goldberg then reported on what was supposed to be a secret dialogue between officials, including Defense Secretary Pete Hegseth and Vice President JD Vance, causing a scandal for the Trump administration.
Secretary of State Marco Rubio is Trump's acting National Security Adviser until he names an official replacement.
Try Our AI Features
Explore what Daily8 AI can do for you:
Comments
No comments yet...
Related Articles
Yahoo
8 hours ago
- Yahoo
Border Officers Capture Alleged Pedophile Wanted In Texas
Officers with Customs and Border Protection captured an alleged pedophile at the Mexico border earlier this week. CBP officers arrested Noe Magallen, a 71-year-old American citizen, at the Progreso Port of Entry on June 5, according to a press release. Magellan was wanted for 'indecency with a child by sexual contact' in Hidalgo County, Texas. 'Our frontline CBP officers maintained their vigilance and uncovered a man wanted on a significant alleged offense of a sexual nature involving a child,' said Port Director Michael Martinez in the release. Officers at the Progreso International Bridge – between McAllen and Brownsville – referred Magallen for 'secondary inspection,' according to the release. They used 'federal law enforcement databases and biometric verification' to check his identity. Then, officers found he was wanted by the Hidalgo County Sheriff's Office on a 'felony arrest warrant' for alleged sexual indecency with a child. 'Magallen was turned over to the Hidalgo County Sheriff's Office deputies for adjudication of the warrant,' the release reads. 'Defendants are presumed innocent unless proven guilty in a court of law.' Magallen was booked on June 5, according to jail records. He faces one charge of indecency with a child by sexual contact, which allegedly occurred on August 2, 2022. He was previously arrested twice in 2000 for driving while intoxicated. The National Crime Information Center is a 'centralized automated database' for police to collaborate on 'outstanding warrants,' according to the release. As The Dallas Express reported at the time, CBP officials cited the same system in May after arresting wanted sex offenders. 'Apprehensions like these exemplify CBP's continued commitment to our border security mission and protecting our communities,' Martinez said in the release.
Yahoo
12 hours ago
- Yahoo
Investigators looking at who sent Hegseth's Signal texts, sources say
Pentagon investigators are looking into whether Department of Defense Secretary Pete Hegseth personally wrote the text messages detailing the military's plans to strike Houthi targets in Yemen or whether other staffers typed out those details, according to two people familiar with the ongoing probe. The Defense Department's Office of Inspector General has spent several weeks interviewing Hegseth's current and former staff members to figure out how United States strike details taken from a classified system wound up in a commercial messaging app known as Signal. "Because this is one of the DOD IG's ongoing projects, in accordance with our policy we do not provide the scope or details to protect the integrity of the process and avoid compromising the evaluation," DOD IG spokesperson Mollie Halperin told ABC News. The details were relayed in two chat groups that included Hegseth - one with Vice President JD Vance and other high-ranking officials, and a second one that included Hegseth's wife, who is not employed by the government. MORE: Pentagon watchdog launches probe into Hegseth use of Signal chat ahead of Houthi airstrike It remains unclear how soon the findings will be released. Hegseth is scheduled to testify for the first time as defense secretary on Tuesday, where Democratic lawmakers are expected to question his handling of classified and sensitive information. The sharing of the details reportedly occurred around the same time in mid-March when key members of President Donald Trump's National Security Council, including Hegseth, inadvertently shared details about the March 15 missile strike in Yemen with the editor-in-chief of The Atlantic. Much of the same content was shared in the second encrypted chat with family members and others -- a chat group that Hegseth had created on his personal phone during his confirmation process that included his wife, Jennifer Hegseth, the two officials told ABC News. MORE: What to know about Signal, which the Pentagon previously discouraged workers from using In addition to looking at whether the information was classified and who wrote it, investigators are also asking whether any staff members were asked by Hegseth or others to delete messages, according to one person familiar with the IG probe. The government is required under law to retain federal communications as official records.
13 hours ago
Investigators looking at who sent Hegseth's Signal texts, whether they were told to delete them, sources say
Pentagon investigators are looking into whether Department of Defense Secretary Pete Hegseth personally wrote the text messages detailing the military's plans to strike Houthi targets in Yemen or whether other staffers typed out those details, according to two people familiar with the ongoing probe. The Defense Department's Office of Inspector General has spent several weeks interviewing Hegseth's current and former staff members to figure out how United States strike details taken from a classified system wound up in a commercial messaging app known as Signal. "Because this is one of the DOD IG's ongoing projects, in accordance with our policy we do not provide the scope or details to protect the integrity of the process and avoid compromising the evaluation," DOD IG spokesperson Mollie Halperin told ABC News. The details were relayed in two chat groups that included Hegseth - one with Vice President JD Vance and other high-ranking officials, and a second one that included Hegseth's wife, who is not employed by the government. It remains unclear how soon the findings will be released. Hegseth is scheduled to testify for the first time as defense secretary on Tuesday, where Democratic lawmakers are expected to question his handling of classified and sensitive information. The sharing of the details reportedly occurred around the same time in mid-March when key members of President Donald Trump's National Security Council, including Hegseth, inadvertently shared details about the March 15 missile strike in Yemen with the editor-in-chief of The Atlantic. Much of the same content was shared in the second encrypted chat with family members and others -- a chat group that Hegseth had created on his personal phone during his confirmation process that included his wife, Jennifer Hegseth, the two officials told ABC News. In addition to looking at whether the information was classified and who wrote it, investigators are also asking whether any staff members were asked by Hegseth or others to delete messages, according to one person familiar with the IG probe. The government is required under law to retain federal communications as official records.
