We are aware of recent reports regarding targeted phishing attacks that have resulted in account takeovers of some Signal users, including government officials and journalists.
-
@kkarhan@infosec.space @signalapp@mastodon.world @Mer__edith@mastodon.world I do boycott Signal for the same reason - I will not use a messenger that requires a phone number.
Also because my phone number already changed like 5 to 10 times in my life. It simply sucks as an identifier.
But this has nothing to do with the attack in question, and nothing at all with control over usernames as you alluded to in your previous post. You can literally attack every service that does SMS 2FA with that (also a good reason to not do SMS 2FA, neither any other phone number identified 2FA - as it means that all you need for a good phish is the the phone number, which both allows you to attempt account recovery and is also a communication channel from you to your victim. I can list a bunch of services that are very likely vulnerable to the exact same attack:
- Telegram
- WhatsApp
- Gmail
- Your bank account (in particular basically all US banks)
- GitHub
Personally I am still using #Matrix, but I don't quite like it either. The protocol is overengineered and all clients suck (and there aren't even many clients to begin with that actually work, which is specifically the case because the protocol is so messy).
I actually had used XMPP before, but for me it kinda died when mobile devices came along and XMPP didn't learn a good way for push notifications without keeping a TCP connection to the service open at all times . Really sucks when e.g. being on a train. Seems XEP-0357 from 2020 fixes that (not sure if it by now has a good story for multi device + offline messages, so you can connect sometimes with this device, sometimes with that one, and see full message history from both, and can also receive messages when none is online), but that shows the other problem of XMPP: everything is an extension and you can never know which feature set your server supports, and then you also need to know which feature set works with the people you talk to... IMHO they should collect a good set of XEPs and name it Jabber 2.0 or whatever, then servers and clients at least know what to align to. With that XMPP would actually have good chances at replacing Matrix.@divVerent @signalapp @Mer__edith Yeah, I know folks that have changed phone numbers more frequent than addresses, license plates, employers and cars in the same time...
- Some places even treat #PhnoneNumbers as "immuteable"...
- See r / #SoftwareGore!
- Some places even treat #PhnoneNumbers as "immuteable"...
-
@vfrmedia @gettie Point is that #Telco regulations stems from #Telegraphy and #Postal operations, and whilst there are legitimate reasons for #regulators to disconnect phone lines (otherwise #robocalling and #SMS-#Spam would be even more rampant than #eMail-#Spamming!)
- Which OFC also intertwines with "#LawfulInterception" and the means of Governments to exercise control.
- So anything claiming #security must inherently acknowledge the unfixable #insecurity of the #PSTN and completely cease using it and it's per-design compromised Infrastructure as a matter of principle.
That's why any "#secure communications" treats it as a hostile network and not to be trusted!
- And that's not even scratching the surface that countries try to outlaw #anonymity - starting with #Prepaid - #SIM - Cards.
- Because those traditionally had no reason for "#KYC" as there was no means for a customer to incur #debt or commit #fraud against the telco that provided said services, so there was [and IMHO still is] no "legitimate interest" in demanding any #ID for those, as any crime committed would be investigated with the existing #Govware inside the networks and thus found out.
UK still sells prepaid SIMs but all providers either nudge you to have them delivered to a physical address and only allow cashless topups, or if you buy them from the shop it has CCTV (authorities have used this to catch those using PAYG SIMs for drug dealing lines and/or gang activity)
I'm slightly surprised I haven't been pulled over as I've been driving around with as many as 6-7 active mobile devices in my car (driving solo in a relatively small hatchback), but I suspect authorities already know from ANPR and my movements (plus the nature of these SIMS and devices) they are for frontline health and social care workers and not anything sinister..
- Which OFC also intertwines with "#LawfulInterception" and the means of Governments to exercise control.
-
UK still sells prepaid SIMs but all providers either nudge you to have them delivered to a physical address and only allow cashless topups, or if you buy them from the shop it has CCTV (authorities have used this to catch those using PAYG SIMs for drug dealing lines and/or gang activity)
I'm slightly surprised I haven't been pulled over as I've been driving around with as many as 6-7 active mobile devices in my car (driving solo in a relatively small hatchback), but I suspect authorities already know from ANPR and my movements (plus the nature of these SIMS and devices) they are for frontline health and social care workers and not anything sinister..
@vfrmedia @gettie In fact, many places will literally note that down in their #LawfulInterception system (i.e. in Germany).
- I.e. not only are providers banned from listing designated crisis helplines`(that are 0800 numbers) but if police try to query call records from someone with *"confidentiality privilegues" like lawyer, psychologist, doctor, psychatrist, notary, rehab clinic, addiction help center, etc. they get a BIG ASS RED WARNING BOX when they check for that number that said line is subject to said privilegues and that they cannot monitor it without warrant and have to file that with the request.
- So even if they ever looked up why half a dozen devices are there, they'd quickly came to the conclusion that you are a known bona fide user and the other devices are too.
Tho for most stochastic surveillance the number of SIMs and devices isn't that high that you'd cause suspicion, given a lot of #IoT garbage has at least a #4G or #5G - modem in it to send telemetry and that 7 devices can also be assumed 1 fro the #eCall of the car and 3 people with 1 #DualSIM phone or a regular phone + laptop with WWAN modem each.
- I.e. not only are providers banned from listing designated crisis helplines`(that are 0800 numbers) but if police try to query call records from someone with *"confidentiality privilegues" like lawyer, psychologist, doctor, psychatrist, notary, rehab clinic, addiction help center, etc. they get a BIG ASS RED WARNING BOX when they check for that number that said line is subject to said privilegues and that they cannot monitor it without warrant and have to file that with the request.
-
@unaegeli
-That's a different code
-It's very clearly a popup, and not in a chat
-To abuse it, one would already need access to the account, i.e. through having completed the other attackI feel like that reminder is distinct enough as it is
@signalappI see the difference now, thanks.
-
@vfrmedia @gettie In fact, many places will literally note that down in their #LawfulInterception system (i.e. in Germany).
- I.e. not only are providers banned from listing designated crisis helplines`(that are 0800 numbers) but if police try to query call records from someone with *"confidentiality privilegues" like lawyer, psychologist, doctor, psychatrist, notary, rehab clinic, addiction help center, etc. they get a BIG ASS RED WARNING BOX when they check for that number that said line is subject to said privilegues and that they cannot monitor it without warrant and have to file that with the request.
- So even if they ever looked up why half a dozen devices are there, they'd quickly came to the conclusion that you are a known bona fide user and the other devices are too.
Tho for most stochastic surveillance the number of SIMs and devices isn't that high that you'd cause suspicion, given a lot of #IoT garbage has at least a #4G or #5G - modem in it to send telemetry and that 7 devices can also be assumed 1 fro the #eCall of the car and 3 people with 1 #DualSIM phone or a regular phone + laptop with WWAN modem each.
my car is just a few months before ecall was implemented (and it doesn't even work on some cars as 3G got ceased here), and some of the more modern cameras around these days would show I'm obviously driving solo and often at unusual hours of the night.
Although any tracking would also show I take the same route every day between either my home and workplace, or sometimes the coastal town where some of our staff are.
There is /some/ monitoring of social care workers as during Covid there were a few drugdealers pretending to be them (even getting uniforms etc), as well as healthcare workers themselves going rogue (I've noticed our staff are getting more attention from the Police recently, checking their cars are 100% legal)
- I.e. not only are providers banned from listing designated crisis helplines`(that are 0800 numbers) but if police try to query call records from someone with *"confidentiality privilegues" like lawyer, psychologist, doctor, psychatrist, notary, rehab clinic, addiction help center, etc. they get a BIG ASS RED WARNING BOX when they check for that number that said line is subject to said privilegues and that they cannot monitor it without warrant and have to file that with the request.
-
Hmmm, and what about the monthly reminder to enter the personal smartphone code? How to differentiate this from the other?
@unaegeli @signalapp i know right??
-
These attacks, like all phishing, rely on social engineering. Attackers impersonate trusted contacts or services (such as the non-existent “Signal Support Bot”) to trick victims into handing over their login credentials or other information. To help prevent this, remember that your Signal SMS verification code is only ever needed when you are first signing up for the Signal app.
@signalapp probably doesn't help that your app suggests that I verify my PIN - which apparently I will ever need? - every time I'm in it.
-
my car is just a few months before ecall was implemented (and it doesn't even work on some cars as 3G got ceased here), and some of the more modern cameras around these days would show I'm obviously driving solo and often at unusual hours of the night.
Although any tracking would also show I take the same route every day between either my home and workplace, or sometimes the coastal town where some of our staff are.
There is /some/ monitoring of social care workers as during Covid there were a few drugdealers pretending to be them (even getting uniforms etc), as well as healthcare workers themselves going rogue (I've noticed our staff are getting more attention from the Police recently, checking their cars are 100% legal)
@vfrmedia I mean in any juristictions it's legal for police to randomly pull over cars, check license & registration and ask for mandatory safety equient like Warning Triangle, First Aid Kit and Retroflective Vest to be presented.
- And that is being used by the police to both gather intelligence as well as annoy individuals (i.e. motorists joyriding) out of an area.
- I mean, police do it all the time whenever they feel like it, and whilst theybdon't admit to it, I'm pretty shure they check way more plates than they pull over because they prefer to skip all the uninteresting ones…
- Cuz lets face it: It'll only waste time if they pull over some retirement-aged women who's only negative data on file - a parking ticket in the 1990s - is long expunged from records vs. someone with a decent record driving suspiciously orderly…
- And that is being used by the police to both gather intelligence as well as annoy individuals (i.e. motorists joyriding) out of an area.
-
To protect people from such phishing, Signal actively warns users against sharing their SMS code and PIN.
We also want to emphasize that Signal Support will *never* initiate contact via in-app messages, SMS, or social media to ask for your verification code or PIN. If anyone asks for any Signal related code, it is a scam. We make this clear when users receive their SMS code during initial signup.
@signalapp@mastodon.world #Alt4You Better alt-text
A SMS message from Signal, reads:
SIGNAL code: 751912. Do not share this code with anyone. If anyone asks it's a SCAM. Our reps will NEVER ask for it. -
@vfrmedia I mean in any juristictions it's legal for police to randomly pull over cars, check license & registration and ask for mandatory safety equient like Warning Triangle, First Aid Kit and Retroflective Vest to be presented.
- And that is being used by the police to both gather intelligence as well as annoy individuals (i.e. motorists joyriding) out of an area.
- I mean, police do it all the time whenever they feel like it, and whilst theybdon't admit to it, I'm pretty shure they check way more plates than they pull over because they prefer to skip all the uninteresting ones…
- Cuz lets face it: It'll only waste time if they pull over some retirement-aged women who's only negative data on file - a parking ticket in the 1990s - is long expunged from records vs. someone with a decent record driving suspiciously orderly…
@kkarhan here they tend to use ANPR hits and sometimes "public concerns" (there's a lot of nosey white folk reporting all the social carers for perceived bad driving simply because the carers are Black and brown)
UK just needs valid inspection record, tax and insurance (which cops can often check via mobile data terminals without going near the car), we aren't required to have the triangle, first aid kit and hi vis (although I carry these things anyway simply as it makes sense to have them)
- And that is being used by the police to both gather intelligence as well as annoy individuals (i.e. motorists joyriding) out of an area.
-
While we build robust technical safeguards, user vigilance is ultimately the best defense against phishing. We will continue to work on mitigating these risks via interface design and signposting throughout the app. In the meantime, please stay alert, and never share your SMS verification code or Signal PIN with anyone.
@signalapp SMS!?
-
We are aware of recent reports regarding targeted phishing attacks that have resulted in account takeovers of some Signal users, including government officials and journalists. We take this very seriously.
To be clear: Signal’s encryption and infrastructure have not been compromised and remain robust. These attacks were executed via sophisticated phishing campaigns, designed to trick users into sharing information – SMS codes and/or Signal PIN – to gain access to users’ accounts.
@signalapp it is perfectly clear. RUP to the people who got duped's accounts
-
We are aware of recent reports regarding targeted phishing attacks that have resulted in account takeovers of some Signal users, including government officials and journalists. We take this very seriously.
To be clear: Signal’s encryption and infrastructure have not been compromised and remain robust. These attacks were executed via sophisticated phishing campaigns, designed to trick users into sharing information – SMS codes and/or Signal PIN – to gain access to users’ accounts.
They also get your phone number, and all the information attached to it.
Do not use Signal, or any other app that demands a phone number.
-
While we build robust technical safeguards, user vigilance is ultimately the best defense against phishing. We will continue to work on mitigating these risks via interface design and signposting throughout the app. In the meantime, please stay alert, and never share your SMS verification code or Signal PIN with anyone.
@signalapp implementing authentication using more secure methods (passkeys, physical security keys) could eliminate that risk.
-
@ExcelAnalytics @signalapp not only that, the entire concept of demaning a #PhoneNumber to use #Signal is inherently and irredeemably wrong to begin with!
@kkarhan
This has always struck me as the strangest complaint about Signal.You don't need to distribute your phone number to actually communicate with other signal users.
Presumably you want some form of 2fa, because losing your account would be bad.
And you don't want to be tied to some cloud based email provider.
And it's literally a phone app so every single user has the dependency.
-
@kkarhan
This has always struck me as the strangest complaint about Signal.You don't need to distribute your phone number to actually communicate with other signal users.
Presumably you want some form of 2fa, because losing your account would be bad.
And you don't want to be tied to some cloud based email provider.
And it's literally a phone app so every single user has the dependency.
@lackthereof it's not a "strange complaint", but a massive problem, because it creates dependency on a proven insecure network that is more often than not controlled if not run by hostile actors…
- Also #eMail, like #XMPP+#OMEMO, is based around #OpenStandards so you ain't forced to use any provider that is subject to #CloudAct nor known to snitch on customers without a valid domestic warrant…
- And if you trust noone, you can just host your eMail Server on a Rasberry Pi at home. It'll certainly be less convenient and more expensive but the you also get all the benefits of it being not possible to seize it without breaking into your home.
@signalapp mandating #PhoneNumners is a huge red flag because at best any #PhoneNumber is pseudonymous like a #Shitcoin-Wallet and that any #privacy is broken the moment it has any (even remotely circumstantial) connection to someone.
- Because even if you ain't forced into #SelfDoxxing to obtain a #Prepaid - #SIM (aka. "#KYC") and/or Phone Number it is still a bad design.
Not to mention #Signal's #App is a huge shitshow…
- Also #eMail, like #XMPP+#OMEMO, is based around #OpenStandards so you ain't forced to use any provider that is subject to #CloudAct nor known to snitch on customers without a valid domestic warrant…
-
@lackthereof it's not a "strange complaint", but a massive problem, because it creates dependency on a proven insecure network that is more often than not controlled if not run by hostile actors…
- Also #eMail, like #XMPP+#OMEMO, is based around #OpenStandards so you ain't forced to use any provider that is subject to #CloudAct nor known to snitch on customers without a valid domestic warrant…
- And if you trust noone, you can just host your eMail Server on a Rasberry Pi at home. It'll certainly be less convenient and more expensive but the you also get all the benefits of it being not possible to seize it without breaking into your home.
@signalapp mandating #PhoneNumners is a huge red flag because at best any #PhoneNumber is pseudonymous like a #Shitcoin-Wallet and that any #privacy is broken the moment it has any (even remotely circumstantial) connection to someone.
- Because even if you ain't forced into #SelfDoxxing to obtain a #Prepaid - #SIM (aka. "#KYC") and/or Phone Number it is still a bad design.
Not to mention #Signal's #App is a huge shitshow…
@kkarhan
Email is, in practice, a privacy shit show equal to or greater than phone numbers. Either you self-host, which means you have an isp and a DNS provider at minimum who can reveal your identity on their whims, even if you lie on a whois record. Or you use one of the mega free providers with all their conflicts of interest and data mining. Or you use a paid provider which opens up all the payment chain to trace back to you on top of everything elseTo get a phone number I can walk to the corner convenience store and, with cash payment and no ID, purchase a prepaid SIM card. I can pay cash to refill it every month.
- Also #eMail, like #XMPP+#OMEMO, is based around #OpenStandards so you ain't forced to use any provider that is subject to #CloudAct nor known to snitch on customers without a valid domestic warrant…
-
S strit@mastodon.social shared this topic
