WenAstarApr 28
Signal

A response to recent reporting in Germany, in service of clarity and accountability:

First, it’s important to be precise when it comes to critical infrastructure like Signal. Signal was not “hacked” — in that our encryption, infrastructure, and the integrity of the app’s code was not compromised. 1/

Apr 27 at 8:54pmWeb
Show threadSignalApr 27
However, sophisticated attackers have engaged in a harmful phishing campaign, posing as “Signal Support” by changing their profile display name and using social engineering to trick people into handing over their credentials — information that allowed these attackers to take over some targeted Signal accounts. This is something that plagues any mainstream messaging app once it reaches the scale of Signal, but we know how high the stakes are given the trust people place in us. 2/
Show threadSignalApr 27
In the coming weeks, you’ll see us rolling out a number of changes to help hinder these kinds of attacks. 3/
Show threadSignalApr 27
Because we don’t collect user data, what we know about these attacks comes from the victims of phishing. And from what victims have told us, the attacks followed a broad pattern: after tricking people into revealing their Signal credentials, attackers then used those credentials to take over their account and also frequently changed the associated phone number. 4/
Show threadSignalApr 27
Because such a change results in de-registering your Signal accounts, attackers prepared people for this by telling them that being de-registered was intended behavior, and that all they would need to do is “re-register,” or, create a new account. When they moved to create a new Signal account — one that was now decoupled from their hijacked account — the victims thought they were logging back in to their primary account. 5/
Show threadSignalApr 27
As a result, many didn't notice the takeover. The compromised accounts were then weaponized to target the victims' contact lists by posing as the owners of the account. 6/
Show threadSignalApr 27
We understand the trust that people put in Signal, and how devastating this kind of social engineering can be. While it’s true that all messaging platforms are susceptible to scammers and phishing that betrays people’s trust and convinces them to “unlock the front door” where no backdoor exists, we are looking to do everything we can to help people avoid and detect such scams. 7/
Show threadSignalApr 27
For the time being, please stay vigilant against phishing and account takeover attempts. Remember that no one from Signal Support will ever send you a message request or ask for your registration verification code or Signal PIN. For an added layer of protection, you can enable Registration Lock in your Signal Settings (Account -> Registration Lock). 8/
Show threadjtbApr 27
@signalapp What credentials? not just a phone number presumably.
Show threadDavid Penfold Apr 27

@jtb Read the thread 👍

@signalapp

Show threadjtbApr 27

@davep @signalapp If they handed over verification code and pin then they would have to be seriously daft.

[I withdrew this later. It was prompted by incredulity. I hope I will be forgiven and not sent to X for punishment]

Show threadDavid Penfold Apr 27

@jtb It's how phishing / social engineering works. Not everyone is as clever as you.

@signalapp

Show threadMagnus AhltorpApr 27
@davep @jtb @signalapp Also, everyone who thinks they can't be fooled by social engineering is very susceptible to social engineering. Which is why it is very important for a cryptographic system to try to guard against these types of attack as much as they can.
Show threadDavid Penfold Apr 27
@ahltorp @jtb @signalapp Indeed
Show threadClaudiusApr 28
@davep @ahltorp @jtb Typically, I'd agree. But these accounts are some of the highest politicians in Germany. I don't believe it's unreasonable to hold them to higher standards than the average user. They handle confidential stuff. Their decisions and actions concern tens of millions of people.
Show threadGrumble 🇺🇸 🇺🇦 🇬🇱Apr 28

@claudius @davep @ahltorp @jtb They handle confidential stuff irresponsibly.

Or maybe they were just drunk? That's how Whisky Pete Hegseth does it.

Show threadAlien software, human hardwareApr 28
@claudius @davep @ahltorp @jtb have you seen German politicians talk?
Show threadRadieschenApr 28

@claudius why should technical skills like that be a requirement for people to have something to say in politics? The stakes are too high as they are now, you need to have rhetoric skills, a mindset to make it to the top and a bunch of other privileges.

We shouldn't individualize everything, it's a structural problem and there should be structural measures in place to prevent politicians from making those mistakes. It's a government we're talking about, they have the resources.

@davep @ahltorp @jtb

Show threadDavid Penfold Apr 28

@radieschen 💯

@claudius @ahltorp @jtb

Show threadClaudiusApr 28

@radieschen @davep @ahltorp @jtb I am not saying they must be perfect. But if they are not they need to get themselves help.

And, as pointed out, they need better than average opsec *anyway* because they also should not leave hardcopies of sensitive stuff in a cab or paste their plans for some upcoming regulation into ChatGPT.

Yes, that is the bar I would set for a politician. Yes, we also need structural help. Both of these are desirable.

Show threads4mmyApr 29
@claudius @radieschen @davep @ahltorp @jtb I agree that their opsec should have prevented it. What I don’t agree on is, that they should have higher standards like the rest. If there are better default settings and/or actions to prevent phishing this should apply to everyone and not just important politicians.
Show threadClaudiusApr 29

@s4mmy @radieschen @davep @ahltorp @jtb honestly, I find it unreasonable to *not* set higher standards for people in such an exposed office. Again: I am all for structurally preventing attacks where possible. But at the same time, these are not random people, they are under far more scrutiny and are much higher value targets for attacks like these. IMO this needs to be part of their threat model.

I don't think we'll reach a consensus, here if we can't agree on that.

Show threadRadieschenApr 29

@claudius the only thing I'm disagreeing with in your reply above is that I don't think they should get help, I think they should be trained.

Because people like that need to have better than average op-sec, it *must* not be their responsibility. The problem is so huge, *everyone* needs to be made aware of common threats.

Structural problems need structural solutions. Relying on individuals to be aware they have to educate themselves can only go wrong. It's only a matter of when, IMO.

@s4mmy @davep @ahltorp @jtb

Show threadjtbApr 29

@radieschen I used to work in the NHS, it was forbidden to communicate sensitive information by email etc. I see France has its own app. But maybe politicians like everyone else just want to be on the same app everyone else is using. Normally Whatsapp. It's hard to get people to move.

https://interoperable-europe.ec.europa.eu/collection/open-source-observatory-osor/news/public-sector-employees-required-use-french-developed-tchap-app

Public sector employees required to use French-developed Tchap app

The French government mandates the use of the open source communication platform Tchap to public officials.

Interoperable Europe Portal
Show threadDavid Penfold Apr 29

@claudius
It's definitely part of their threat model, whether they recognise that or not.

Frankly, due to this, they should be using a modified version of Signal for government officials that removes the risk of this sort of account takeover.

@s4mmy @radieschen @ahltorp @jtb

Show threaddirtsideApr 28
@radieschen @claudius @davep @ahltorp @jtb agreed. as an example, we have here in the US the Secret Service whose job is (among other things) to protect the president from physical threats. it is not the president's job to do threat analysis or secure locations. similarly there should be a technical branch that provides secure tools that are highly resistant to being misused, rather than govt officials just using off the shelf software on their own initiative.
Show threadAchim DommaApr 28

@claudius You seem to be from Germany, so you are joking. Right?

@davep @ahltorp @jtb

Show threadThe Stage Rabbit (he/him)Apr 28

@ahltorp @davep @jtb @signalapp People have been trying to scam me since the 90s and I've always seen through it or taken a moment to check. Even so, I got had a couple of months ago by a very obvious piece of social engineering. All it takes is being tired, or stressed, or distracted, or all three, and you just go into automatic when asked to do something. I had to change all my passwords, update all my 2FA, change email addresses used for logins, etc.

It can happen to anyone.

Edit: typo

Show threadjtbApr 28
@stagerabbit @ahltorp @davep @signalapp ok maybe, but banks are saying all the time not to give out pin even to bank staff.
Show threadThe Stage Rabbit (he/him)Apr 28
@jtb @ahltorp @davep @signalapp And they are saying that because people do. Because it's easy for a con artist to convince some people who may just be vulnerable at that moment to give it to them.
Show threadjtbApr 28
@stagerabbit @ahltorp @davep @signalapp ok i withdraw my remark as I didn't see the dialog. If it said "verify pin" someone might have done that without thinking
Show threadDavid Penfold Apr 28

@jtb @stagerabbit @ahltorp @signalapp

Fair enough. Social engineers and phishing scams are by definition very good at this.

Show threadiestynapApr 28
@jtb @stagerabbit @ahltorp @davep @signalapp You still get those bona fide people on the phone who ask 'can you confirm your ...' (dob, account number, whatever), who then expect you to *give* them the detail for them to check. So it's not surprising that people can be tricked into 'confirming' online.
Show threadEarth NotesApr 28
@jtb @stagerabbit @ahltorp @davep @signalapp Banks and others regularly call me up and ask me to identify myself to them, ie give the unknown caller my credentials. And cannot see the problem in training their customers to comply.
Show threadThe Stage Rabbit (he/him)Apr 28

@EarthOrgUK @jtb @ahltorp @davep @signalapp Both my life insurance company and my overseas bank want me to send copies of my passport and proof of address over unencrypted email. When I complain, they say I should password protect the file and send the password in a separate unencrypted email to the same address.

Even if I find a way to send it securely, based on this, I doubt they store it securely.

Show threadThe Stage Rabbit (he/him)Apr 28
@EarthOrgUK @jtb @ahltorp @davep @signalapp And they've locked my account for KYC reasons until I do it. Damned if you do, damned if you don't.
Show threadDavid Penfold Apr 28
@stagerabbit @EarthOrgUK @jtb @ahltorp @signalapp
That is awful practice.
Show threadThe Stage Rabbit (he/him)Apr 28
@davep @EarthOrgUK @jtb @ahltorp @signalapp We're talking about the sector that holds our life savings and limits passwords to 8-12 alpha numeric characters and until recently no form of 2FA. Not sure why this surprises you. (If this isn't the case elsewhere, it's still the case in Japan, where I live. Not super impressed by my Canadian banks either, tbh.)
Show threadDavid Penfold Apr 28
@stagerabbit @EarthOrgUK @jtb @ahltorp @signalapp
At least I had to physically go to my local post office to activate my digital identity here in France.
Show threadMagnus AhltorpApr 28

@stagerabbit @davep I think most of the banks in Sweden are at least ok in this regard. I’ve had online banking for 30 years (pre internet), and it has always been two-factor. In the beginning only pin and single-use codes, but very quickly it became smartcard-based challenge-response with pin unlock of the smartcard, so theoretically very secure.

I’ve only done hanko based banking in Japan, so I’ve never seen online banking in Japan, but that seems horrible.

Show threadThe Stage Rabbit (he/him)Apr 28
@ahltorp @davep You're lucky in Japan if your bank even has it and then doesn't charge you 2500 yen a month to use it.
Show threadgsecApr 28
@stagerabbit @EarthOrgUK @jtb @ahltorp @davep @signalapp If i go to a store and get repeatedly scammed, i don't go there again. If a bank does not handle security in a proper way, I'd leave that bank(I've done that in the past). I don't get how you can stick to your bank, if you believe their security is weak. It's their core competence after all...
Show threadThe Stage Rabbit (he/him)Apr 28
@gsc You are privileged to have choices to switch to. I feel like I've already chosen the least bad options in my situation. I don't know where you live, but in many countries most banks have terrible security practices. @EarthOrgUK @jtb @ahltorp @davep @signalapp
Show threadgsecApr 28
@stagerabbit @EarthOrgUK @jtb @ahltorp @davep @signalapp let me put it this way: if i don't trust them to handle passwords properly, i would not go there and hand them all my money, alternatives or not...
Show threadThe Stage Rabbit (he/him)Apr 28
@gsc Really? You'd go without a bank? I don't think you've considered the implications of not being banked In a society that expects you to be banked.
This is really "well, if he'd said that to *my* mother, I would have punched him out" territory.
@EarthOrgUK @jtb @ahltorp @davep @signalapp
Show threadEarth NotesApr 28

@gsc @stagerabbit @jtb @ahltorp @davep @signalapp I have left one* of the banks in question and filed complaints every single day it took to leave with all my savings. I didn't have the spoons at the time to take it up with the regulators (financial and data), but I have been director/CTO of a regulated fintech, so I am fairly confident that I could get my complaint heard if I could devote 6 months of my time...

*It's complicated.

Show threadgsecApr 28
@EarthOrgUK @stagerabbit @jtb @ahltorp @davep @signalapp well, that is the next (and correct) step. But i see people give up much earlier, like others wronging them, and then there are no consequences at all. Did it suck to have to switch the bank? Of course. Did i complain in written form? Multiple times. Did i loose a lot of time, which would be unnecessary, if they had done their job well? Yes, totally. But i don't regret, and more so, bad shit also happens because we let them. I'm not here to blame anyone who decides to do it differently, but stepping up is always uncomfortable, yet is worth it most of the times.
Show threadEarth NotesApr 28
@gsc @stagerabbit @jtb @ahltorp @davep @signalapp Just did not have the mental bandwidth at the time, but that may change.
Show thread0x06d ago
@stagerabbit
Even the Have I Been Pwned guy slip once.
@ahltorp @davep @jtb @signalapp
Show threadDavid Penfold 6d ago

@0x0 Troy Hunt. Lovely chap.

@stagerabbit @ahltorp @jtb @signalapp

Show threadNikolai Hampton 💾6d ago

@ahltorp @davep @jtb @signalapp as a real world story. I work in cyber security. The team I work with is a very experienced security conscious team of devs (many with 20+ years experience).

One got hit with a phish because of a perfectly timed email. The email was obviously a scam IF you weren’t expecting a parcel delivery. Unfortunately, my colleague was expecting a parcel delivery!

The phishers managed to hit the right topic and context and a timing window that coincided with a highly anticipated, expected delivery, from that exact carrier at about the right time.

Luckily he realised within minutes and was able to move quickly to change passwords and reset credentials.

This wasn’t even spear phishing or any sort of targeted, social engineering supported attack. It was just luck and timing.

Show threadMagnus Ahltorp6d ago
@nikolaihampton @davep @jtb Yes, it's the spam principle. You only have to have a small click-through percentage, doesn't matter if most of the recipients ignore it.
Show threadGiliellApr 29
@davep @jtb @signalapp Yeah, but one of those not so clever people holds the second highest office in Germany and used the Signal account to evade mandatory saving of communication