So one of their servers had a /heapdump endpoint that publicly served a heap dump of the server? This whole saga is out of control.
This group didn’t really “publish” anything, though. They’re offering access to journalists through a request form. They’re also not saying how much actual message content they have because the 410GB of heap dumps makes for a bigger headline number.
mingus88 · 9h ago
Can you imagine co-opting a trusted and secure (and free) bit of software and just making it worse at seemingly every turn?
And charging for it?!
I’m not sure what is more embarrassing: to be the company or to be a user.
hypeatei · 9h ago
Why would the company be embarrassed? The users (i.e. high level U.S. officials) did no due diligence. Of course a private company is going to take the easiest and cheapest route. If it goes bad, just shut down and spin up a new entity.
Some speculate this was intentional intelligence gathering by the Israelis which is plausible too.
n2d4 · 8h ago
> Some speculate this was intentional intelligence gathering by the Israelis which is plausible too.
How does this make sense? If they were gathering data, why would they add a public download? Surely the Israeli officials would not want foreign powers to access this?
Per Hanlon's razor, I don't think this is attributable to anything other than incompetence.
jojohohanon · 7h ago
There’s room for both sides of the razor. The heapdumpz could be there maliciously, but incompetently made globally accessible.
pigbearpig · 7h ago
From the Wired article: "The archive server is programmed in Java and is built using Spring Boot, an open source framework for creating Java applications. Spring Boot includes a set of features called Actuator that helps developers monitor and debug their applications. One of these features is the heap dump endpoint,"
So the heapdumps being available is a Spring Boot feature so it does not appear to be malicious.
evrflx · 6h ago
This feature must be explicitly enabled, it is not on by default nor by accident.
bryanrasmussen · 5h ago
huh, I sure seem to be needing to debug this a lot, I guess I'll just leave it turned on all the time that way I can say a few seconds next time. Larry Wall says one of the virtues of being a great developer is laziness!
No comments yet
barbazoo · 7h ago
Two things can be true at once. Them using their access to unencrypted messages for nefarious purposes and them being incompetent at the same time leaving that endpoint open.
notpushkin · 7h ago
I mean, one doesn’t preclude the other. This could be an incompetent intentional intelligence gathering.
g-b-r · 8h ago
I mean, it could theoretically have been to provide plausible deniability, but it seems extremely more likely to have been incompetence and carelessness (and if they were also sending everything to Israel, it was probably through some unencrypted ftp upload).
dylan604 · 8h ago
>Some speculate this was intentional intelligence gathering by the Israelis which is plausible too.
Which does not bode well for the customers' counter intelligence abilities
donnachangstein · 5h ago
> The users (i.e. high level U.S. officials) did no due diligence.
But why would they? It's not their job. They have massive IT staff supporting them. "High level U.S. officials" are just executives; the pointy-haired bosses to the pointy-haired boss. Only difference is these wear little decorative pins over their breast pocket.
Every Fortune 500 company has dedicated IT staff for execs; someone you can call 24/7 and say "my shit's broke" and they respond "we just overnighted you a new phone".
These people couldn't even install an app on their MDM-controlled device, now the narrative has become we expect them to be making low-level IT decisions too?
Next week we'll be scrutinizing Pete Hegseth's lack of thoughts on rotating backup tapes.
Jedd · 5h ago
> ... narrative has become we expect them to be making low-level IT decisions too?
I think that's a misdirection.
The narrative is that:
a) they were using a compromised piece of software
b) they should not have been using that software - not (necessarily) because it was compromised, but because it wasn't US DoD accredited for that use case.
(I understand your point that these guys are not tech savvy, and do not need to be, but they should be regulation-savvy (clearly they either are not, or willingly broke those regulations), and they should be following organisational guidelines that presumably cover the selection and use of these tools types.)
3rdDeviation · 5h ago
Would tend to agree with most of that, but I think the assertion is Petey needed to ask his IT leadership to do the due diligence before diving in, not that he needed to decide using his own depth of skills and experience.
I assume he did and they said it was a bad idea - the memo they'd released a few weeks prior about Signal vulnerabilities seems to suggest a lack of faith in that approach - but he was already banging away on his phone with all the grocery reminders and definitely not battle plans he needs to keep pushing out. Which is also how it feels in the enterprise space these days.
Strange thing to see our bureaucracy start to behave like a corporation instead of the other way around.
danieldk · 5h ago
It is too early to tell, but given that these people openly attack scientists and other experts (they don’t agree with), I wouldn’t be surprised if they ignored advise of their IT experts.
input_sh · 5m ago
It's not too early to tell, we knew from the beginning that the use of Signal (let alone its clone) was not authorised to be used for such communications.
Yes, there's a fleet of people who are supposed to make such tech decisions. The people involved specifically went against those rules. The existence of a group chat using an authorised app is a violation on its own, adding a journalist to it is a violation on top of a violation.
Adding a journalist was accidental, but using such an app (despite it not being approved) is very intentional.
cornholio · 5h ago
IT staff that knew it was illegal to provide them tools for a conspiracy were fired or silenced. So the only people left were their cronies, who instantly complied with their illegal request, to the best of the cronies' abilities. For such national failures, the buck has to stop at the very top, not on some IT monkey.
This is typical for highly corrupt governments and autocracies, they crumble from within because the autocrats can't trust random, competent people so their inner circle becomes saturated with people who are selected on the basis of loyalty not competence, and these people end up making the most important decisions and running the country.
hristov · 5h ago
Their massive it staff provides them with a way to communicate securely and they ignore it deliberately so that their communications are not preserved for history or for future court cases.
TeMPOraL · 4h ago
One man's low Integrity (in the "CIA triad" sense) of communications is another man's improved plausible deniability.
aucisson_masque · 3h ago
The Israeli would have made it secure so only them can access the data because knowing someone else's secret is worth something only when it's still a secret, if china, Russia and everyone can read the log of the American government it's worth nothing.
miki123211 · 40m ago
This is why Signal is so opposed to third-party apps (or forks) that connect to their service.
If you want to keep the branding of Signal being the secure app, you need to make sure that all Signal users are actually using a secure version of Signal.
If an insecure fork (like this one) becomes too popular, most groups will have at least one member using it, and then the security is gone.
kube-system · 8h ago
The changes to the application are intentional by all parties because message archiving was required by law.
brookst · 8h ago
Sure, but they were not required to be done incompetently and insecurely.
sneak · 7h ago
The fundamental concept of plaintext archiving (escrow) of messages from e2ee messaging apps is insecure by most definitions.
They could have used user-custody public key cryptography, where the end devices have the pubkey of the customer, and archive only re-encrypted messages to TM that they can’t read.
That is not, of course, what they did. They just archive them in plaintext.
_kb · 8h ago
Well, I suppose technically this /heapdump endpoint does satisfy that archive requirement.
yapyap · 3h ago
User for sure
HenryBemis · 5h ago
(read with sarcastic tone) But hey, this is a 'lite' version or a 'red' version (icon is red) or a 'purple' version (icon is purple), so I am cooler that then others that have the standard.
I haven't used WhatsApp for 'a very long time' as I have exited the FB ecosystem, but back in the day I remember seeing "lite" or "WhatsApp+" or other variations of the software. I wouldn't be surprised that those "lite" or "+" come with baggage.
barbazoo · 9h ago
Aren’t those Israeli software companies all supposed to be top notch, ex Mossad, yadda yadda? Doesn’t sound like it.
I hope the message dump is juicy.
msy · 7h ago
And SBF of FTX fame was ex-Jane St so obviously was a serious finance professional. This is why using past employers as a shorthand for capability is unwise.
sillystu04 · 2h ago
In fairness, FTX had a profitable bankruptcy [1]. So it's still better to be scammed by Jane Street alumni than to be scammed by the usual alumni of Goldman Sachs, JP Morgan etc
How is that fair? It was luck from the AI investment. Pure luck.
gruez · 8h ago
I thought Israel has mandatory military service, so ex-mossad or ex-military signals intelligence doesn't really say much? Presumably they're directing people based on their skill set, so you'd expect most hackers to end up in mossad for their mandatory service.
viraptor · 9h ago
That's not a great generalisation for the whole country. How many ex Mossad people interested in doing actual implementation in tech companies do you think there are? It's like "aren't those US software companies all supposed to be top notch, ex NSA yadda yadda?"
The US only has voluntary military service, so the dynamics are different
lysp · 7h ago
The CEO/Founder of TeleMessage Guy Levit was the head of the Planning and Development Department of an elite technical unit in the Intelligence Corps of the IDF according to bio.
rsynnott · 1h ago
I'm not sure why you'd expect intelligence agency types to be particularly good at engineering, tbh.
coolcase · 34m ago
Yeah the /leakitbaby endpoint was meant for just them, not the world! Doh!
oceanplexian · 7h ago
One problem that smart people tend to make is in thinking that being really smart in one area is generalizable to all others. Just because they're good at AppSec doesn't mean they're good at networking or operating a webserver.
ripley12 · 6h ago
I agree with this. It's surprising how often I encounter people with that belief, because I was disabused of it very early on in my career; this industry is chockablock with people who are brilliant in 1 area and deficient in others.
coolcase · 29m ago
That's why you need teams. Red team for example! Security team. App developers. Code reviews. You need all the process too. Security that relies on one genius is fragile.
karn97 · 5h ago
That sounds more like a stupid person than smart lol
stefs · 2h ago
you can be smart in one area and stupid in others. the "not knowing you're stupid in others" is part of the "stupid in others".
underdeserver · 5h ago
"All supposed to be".
This is a country of 10 million people, a rather heterogeneous one at that. There are going to be better and worse companies.
ExoticPearTree · 1h ago
> Aren’t those Israeli software companies all supposed to be top notch, ex Mossad, yadda yadda?
Working with a few companies like these, I can tell you that the marketing is top-notch, and very aggressive. The products not so. Most get better with time.
H8crilA · 3h ago
They are top notch - at working for profit and for the interests of their country.
treebeard901 · 4h ago
After all the concern over China and TikTok, why is the USG using a foreign chat program at all?
coolcase · 27m ago
SuperPAC and other corruption
jfim · 8h ago
Sounds like someone had a Java app and mistakenly exposed all of the JMX endpoints over HTTP. It's not the default configuration, and likely done out of carelessness.
pigbearpig · 7h ago
From the Wired article, it may not have even been a mistake, depending on the version of Spring Boot.
"Spring Boot Actuator. “Up until version 1.5 (released in 2017), the /heapdump endpoint was configured as publicly exposed and accessible without authentication by default."
davedx · 2h ago
This sounds utterly insane. Is Actuator a standard part of Spring Boot or is it an optional package of some kind?
teekert · 2h ago
Imaging putting up a firewall to mitigate this, then docker compose helpfully opening the ports for you. Security comes in layers.
formerly_proven · 4h ago
This was also part of the exploit chain in the "Volksdaten" incident.
0xbadcafebee · 8h ago
Or intentionally. There could be an APM agent which just lets you run heap dumps any time you want, or they enabled heap-dump-on-crash, or had a heap dump shutdown hook, etc. There's a lot of ways to trigger dumps. If we're talking about a full dump, and the apps were using most of the memory allocated to their container/VM/etc, 410GB is actually not that many dumps (we're probably talking uncompressed). At 4GB/dump, that's around 100, over possibly several years.
I just wonder where they were storing them all? At one place I worked, we jiggered up an auto shutdown dump that then automatically copied the compressed dump to an S3 bucket (it was an ephemeral container with no persistent storage). Wonder if they got in through excessive cloud storage policies and this was just the easiest way to exfiltrate data without full access to a DB.
kbouck · 3h ago
if a heap dump is a copy of all the bytes in memory, then wouldn't "thousands of heap dumps" likely be larger than 410GB?
napkin math:
410GB/1000 dumps = 410MB per dump?
410GB/2000 dumps = 205MB per dump
diggan · 29m ago
Might be filtered somewhat, like extracted all ASCII text then compile that into the dump, rather than just the raw dump files.
Edit: reading the description on the dump again, seems exactly what they did:
> Some of the archived data includes plaintext messages while other portions only include metadata, including sender and recipient information, timestamps, and group names. To facilitate research, Distributed Denial of Secrets has extracted the text from the original heap dumps.
TeleMessage CEO LinkedIn bio - reads like a terrible AI hatchet job:
"At the helm of TeleMessage, my leadership is defined by strategic innovation and a steadfast commitment to advancing telecommunications solutions. With a focus on SaaS products, our team has successfully navigated the industry's evolution, ensuring that we remain at the forefront of technological advancements. My role encompasses not only the oversight of our direction but also the cultivation of a culture that values ethical standards and collaborative success.
Our achievements are anchored in a proven track record of delivering results and solving complex problems with efficiency. Spearheading business development and marketing initiatives, we have established a reputation for excellence within the telecom sector. The acquisition of TeleMessage by Smarsh in 2024 stands as a testament to our team's dedication and my leadership in driving growth and fostering a united vision."
notpushkin · 3h ago
This just reads like a terrible LinkedIn-speak to me.
walrus01 · 3h ago
Sufficiently advanced human written linkedin-speak is indistinguishable from a barely coherent chatgpt 3.5 that's been instructed to speak in business buzzwords.
teekert · 2h ago
Hahaha, I was thinking the exact same thing! I can imagine myself reading this 10 years ago and think: Wow this guy is on top of his CV game, how concise and elegant. But now, everybody has this ultra condensed LinkedIn speak, it has become so cringe, so meaningless.
ulrikrasmussen · 1h ago
"I'm a CEO. We're SaaS. I'm a CEO."
greyface- · 7h ago
It's been weeks since the initial TeleMessage revelation... has the Signal Foundation responded in any way to the news? They condemn open source third-party clients and threaten trademark litigation when people use the "Signal" name in interop projects. Meanwhile, total silence when a defense contractor does the same thing.
ethersteeds · 5h ago
The charitable answer is that organizations across US society are currently all trying to be very still and quiet and not do anything to provoke a vindictive assault by this administration.
The less charitable one is that Moxie was the opinionated and uncompromising core of the Signal Foundation and has been removed from the board and completely vanished from the public eye. What it stands for now is a touch less clear.
Ey7NFZ3P0nzAe · 1h ago
Meredith Whittaker seems kinda fearless though
decimalenough · 3h ago
Signal has done nothing wrong here. There's nothing they could meaningfully say that would do anything except draw heat from people looking for a scapegoat.
This mess is entirely the fault of Telemessage and the people who chose to use it for top-secret comms.
h4ck_th3_pl4n3t · 3h ago
Remember Signal FOSS fork that got cease and desisted?
How is Molly doing these days? Is there an alternative server you could selfhost?
th0ma5 · 7h ago
You're making me wonder if Signal is the customer of the third party and not the government.
jfritsch1984 · 5h ago
We‘re doing something way less critical at my job. But we have two pentests per year by external companies. How on earth is this level of incompetence even legal.
mmooss · 4h ago
Because software engineering is not taken seriously as engineering. What liability is there, for example?
namdnay · 2h ago
I don't think it was. Apparently they faked their SOC2 as well
eskibars · 5h ago
It's not
willmarquis · 6h ago
Exposing unauthenticated /heapdump endpoints in production is a rookie mistake-especially for a service handling sensitive government comms. The presence of MD5 hashes and legacy tech like JSP just adds to the picture of poor security hygiene. This breach is a textbook case of why defense-in-depth and regular audits are non-negotiable.
WatchDog · 6h ago
Great example to use whenever legislators want to ban or add backdoors to e2e encryption.
namdnay · 2h ago
However bad their Signal fork was, at least it was legal. What's crazy is that this very company was also selling a cracked WhatsApp, which is a whole different kettle of fish... and people were buying it! real corporations and governments were buying this crap - it's insane
> and people were buying it! real corporations and governments were buying this crap - it's insane
Anedote: in Wall Street, Global Relay and TeleMessage are the major players when it comes to achieving communication for compliance.
0xbadcafebee · 8h ago
> Because the data is sensitive and full of PII, DDoSecrets is only sharing it with journalists and researchers.
Yeah I'm normally a big proponent of responsible disclosure, but in this case, I think the more painful, damaging leak is required.
Firstly, autocrats, fascists & oligarchs don't care that much if you hack them. They will just keep using these tools (or another one just like it) ignoring the correct procedure their government already wants them to use. The citizens of affected nations need to be made angry by their leaders' failure to do their jobs correctly, and that's only gonna happen when there are consequences for their actions. Their incompetence put their nations at risk, and now it's clear they have failed to keep their intel safe. They have failed hard, let them fail hard.
Second, journalists and researchers have almost completely lost their power. In a non-democratic world (we're nearly there, just give them a little more time), when a journalist exposes corruption or incompetency, that journalist/researcher is simply silenced by the government. Silence the journalists and nobody knows what's going on so oppression can continue unchecked. Every person who gets silenced has a greater chilling effect on the whole society; nobody wants to be next. This is how authoritarians gain power. Oppression with no resistance or consequence legitimizes the oppression.
If we were just talking about typical corporate incompetence re: security, and the only thing at stake is a single stock or individuals' data, I would say disclose responsibly. But when it comes to stopping autocracy, the gloves have to come off. They sure as shit aren't gonna play by any rules, so neither should we.
CobrastanJorji · 8h ago
> The citizens of affected nations need to be made angry by their leaders' failure to do their jobs correctly, and that's only gonna happen when there are consequences for their actions.
This is a really dangerous line of thinking. It's the line of thought that slides forwards to "I love America so much, but to save America I have to get Americans to really feel the pain, and to do that I need to <horrible violence> to them to wake them up and make them see how things are bad."
Hurting people in order to make them see how they are being hurt is almost never the right call.
fumeux_fume · 7h ago
This is a really dangerous line of thinking. It's the line of thought that slides forwards to "I love America so much, but to save America I have lie and cover up the truth of the <horrible violence> being done to them so they'll never see how bad things have gotten."
Lying to people in order to make them never see how they are being hurt is almost never the right call.
rtpg · 5h ago
I feel like it's valuable to not flatten the context here. We are talking about leaking texts by the Trump admin (and I guess some law enforcement agencies using this?).
There is a lot of daylight between dropping a bunch of texts for government officials and committing horrible violence against people as a whole! These are not the same thing! One could be good/fine while the other is bad!
Having said that I would worry for a WikiLeaks-style "oh now this random person's info is out there because it was in one of these e-mails".
I just want to see the gossip
scheeseman486 · 7h ago
You're describing accelerationism and while the ethics behind it are iffy at best, history contends that it does work to help spur revolution.
oivey · 6h ago
That quote does not say anything about citizens inflicting pain on others. That’s such a strange way to read it. It’s saying to vote shitty leaders out. I’m not sure what you think any other possible alternative there could be.
TechDebtDevin · 6h ago
What if you're hurting people to prevent them from hurting people...
3036e4 · 5h ago
They don't need to "silence journalists", since a large number of people were duped to think real truth comes from random anonymous accounts on social media or from some charismatic political influencer they follow. It doesn't matter what leaks are exposed when it can just be handwaved as "fake news" and enough voters will buy that.
Ray20 · 3h ago
>It doesn't matter what leaks are exposed when it can just be handwaved as "fake news" and enough voters will buy that.
Especially in conditions when you don't have to lie at that.
It's not because voters are so gullible that they are ready to believe any word of a charismatic leader. The loss of trust to the mainstream media and to the scientific community is a natural phenomenon in environment when they only tell lies to push their political agenda.
afavour · 7h ago
> The citizens of affected nations need to be made angry by their leaders' failure to do their jobs correctly, and that's only gonna happen when there are consequences for their actions.
The consequences likely wouldn’t be felt by those leaders though. Who knows what info is in those logs about informants, agents etc etc. Leak it openly and they’re dead.
The national broadcaster picked 2 things to report on, then gave the rest of it back to the government.
The act of helping cover this shit up likely changed the course of politics in this country for decades. Theres likely stuff in that cabinet that was well in the public interest and needed disclosure.
Signalgate or whatever is likely the same. And I dont care which party it harms or whatever. It seems relevant that people should have more information, not less considering everything that is happening.
landl0rd · 4h ago
"Responsible disclosure practices don't apply here because I don't agree politically with these people!"
We get you think they're "fascists" or whatever. The majority of the country does not. If you inform your ethical decision-making on this basis expect the majority of the country to oppose you and view you as a criminal.
I don't find your post-hoc justification for contravening what are generally considered ethical standards particularly interesting. If your position is that what you judge to be "autocracy" enables minimally discriminate hacking and leaking of information then expect the right to do the same to kamabla if she ever takes office.
No comments yet
runlevel1 · 6h ago
"clean on OPSEC"
- Pete Hegseth
That line simultaneously becomes funnier and more depressing.
Is this group not very seriously discredited, with ties to FBI, convicted child porn criminals, etc? Or am I getting something mixed up?
This could still be a legitimate leak, of course. I'm just wondering if this info is publically known, or if I'm conflating things
udev4096 · 3h ago
The title is outright wrong and should be criticized for spreading false information. They have NOT published anything, it's only for "researchers", which is a way of saying "we will write false title of this article just so we can get a lot of attention"
nlitsme · 3h ago
I think this is abuse of the word 'publish'
pawanjswal · 4h ago
Wow, this whole TeleMessage leak feels like a spy thriller.
zombiwoof · 5h ago
If no one will persecute criminals they will keep breaking all laws
bob_theslob646 · 7h ago
Isn't it against the law in the United States to use outside channels for government communications? Wasn't this the whole scandal about Clinton? Please correct me if I am wrong.
afavour · 7h ago
Amazingly the app is on the governments list of approved apps. The scandal is what they’re discussing on there: highly sensitive information you normally go to very secure channels to talk about.
rtpg · 5h ago
My understanding is that it was added fairly recently at that, and already this has happened. This must be a record time in "change of policy leading to the most embarassing result". Only a couple of months!
floam · 6h ago
The app exists to comply with the regulations, was my understanding.
goalieca · 7h ago
Security standards need to start banning heap dumps.
GuinansEyebrows · 7h ago
Something tells me that wouldn’t make a huge difference in some of these companies opsec.
sneak · 6h ago
I’m pretty sure they already do, especially endpoints open to the whole internet that are unauthenticated.
lionkor · 4h ago
If only there was a rule saying "don't do that, this would not have happened
treebeard901 · 4h ago
"We are currently clean on OPSEC"
yieldcrv · 8h ago
beautiful, any prediction markets tied to this? I need to stop betting on those things, I’m so bad at it
guluarte · 7h ago
cannot the pentagon with their billions in funding make a secure app?
hn_throwaway_99 · 7h ago
Yes, and they do. The fact that the leaders of our present kakistocracy don't use it should not be an indictment of the civil and military workers in the US military.
sneak · 6h ago
No, the fact that they still work for the US government given “our present kakistocracy” is a sufficient indictment.
pigbearpig · 7h ago
Not when "off the shelf" is the motto. They'd still have to outsource the development and at that point would be questioned why spending that much money when Telemessage sells the product.
Unfortunately, the financial structure doesn't really make it easy for custom DoD software.
TechDebtDevin · 6h ago
Yeah no thanks, not donating to gate keepers who want to maintain the status quo. I'll give my coin to wiki leaks and groups with balls.
This group didn’t really “publish” anything, though. They’re offering access to journalists through a request form. They’re also not saying how much actual message content they have because the 410GB of heap dumps makes for a bigger headline number.
And charging for it?!
I’m not sure what is more embarrassing: to be the company or to be a user.
Some speculate this was intentional intelligence gathering by the Israelis which is plausible too.
How does this make sense? If they were gathering data, why would they add a public download? Surely the Israeli officials would not want foreign powers to access this?
Per Hanlon's razor, I don't think this is attributable to anything other than incompetence.
So the heapdumps being available is a Spring Boot feature so it does not appear to be malicious.
No comments yet
Which does not bode well for the customers' counter intelligence abilities
But why would they? It's not their job. They have massive IT staff supporting them. "High level U.S. officials" are just executives; the pointy-haired bosses to the pointy-haired boss. Only difference is these wear little decorative pins over their breast pocket.
Every Fortune 500 company has dedicated IT staff for execs; someone you can call 24/7 and say "my shit's broke" and they respond "we just overnighted you a new phone".
These people couldn't even install an app on their MDM-controlled device, now the narrative has become we expect them to be making low-level IT decisions too?
Next week we'll be scrutinizing Pete Hegseth's lack of thoughts on rotating backup tapes.
I think that's a misdirection.
The narrative is that:
a) they were using a compromised piece of software
b) they should not have been using that software - not (necessarily) because it was compromised, but because it wasn't US DoD accredited for that use case.
(I understand your point that these guys are not tech savvy, and do not need to be, but they should be regulation-savvy (clearly they either are not, or willingly broke those regulations), and they should be following organisational guidelines that presumably cover the selection and use of these tools types.)
I assume he did and they said it was a bad idea - the memo they'd released a few weeks prior about Signal vulnerabilities seems to suggest a lack of faith in that approach - but he was already banging away on his phone with all the grocery reminders and definitely not battle plans he needs to keep pushing out. Which is also how it feels in the enterprise space these days.
Strange thing to see our bureaucracy start to behave like a corporation instead of the other way around.
Yes, there's a fleet of people who are supposed to make such tech decisions. The people involved specifically went against those rules. The existence of a group chat using an authorised app is a violation on its own, adding a journalist to it is a violation on top of a violation.
Adding a journalist was accidental, but using such an app (despite it not being approved) is very intentional.
This is typical for highly corrupt governments and autocracies, they crumble from within because the autocrats can't trust random, competent people so their inner circle becomes saturated with people who are selected on the basis of loyalty not competence, and these people end up making the most important decisions and running the country.
If you want to keep the branding of Signal being the secure app, you need to make sure that all Signal users are actually using a secure version of Signal.
If an insecure fork (like this one) becomes too popular, most groups will have at least one member using it, and then the security is gone.
They could have used user-custody public key cryptography, where the end devices have the pubkey of the customer, and archive only re-encrypted messages to TM that they can’t read.
That is not, of course, what they did. They just archive them in plaintext.
I haven't used WhatsApp for 'a very long time' as I have exited the FB ecosystem, but back in the day I remember seeing "lite" or "WhatsApp+" or other variations of the software. I wouldn't be surprised that those "lite" or "+" come with baggage.
I hope the message dump is juicy.
[1] https://www.bloomberg.com/news/articles/2024-05-15/ftx-bankr...
The US only has voluntary military service, so the dynamics are different
This is a country of 10 million people, a rather heterogeneous one at that. There are going to be better and worse companies.
Working with a few companies like these, I can tell you that the marketing is top-notch, and very aggressive. The products not so. Most get better with time.
"Spring Boot Actuator. “Up until version 1.5 (released in 2017), the /heapdump endpoint was configured as publicly exposed and accessible without authentication by default."
I just wonder where they were storing them all? At one place I worked, we jiggered up an auto shutdown dump that then automatically copied the compressed dump to an S3 bucket (it was an ephemeral container with no persistent storage). Wonder if they got in through excessive cloud storage policies and this was just the easiest way to exfiltrate data without full access to a DB.
napkin math:
Edit: reading the description on the dump again, seems exactly what they did:
> Some of the archived data includes plaintext messages while other portions only include metadata, including sender and recipient information, timestamps, and group names. To facilitate research, Distributed Denial of Secrets has extracted the text from the original heap dumps.
https://ddosecrets.com/article/telemessage
"At the helm of TeleMessage, my leadership is defined by strategic innovation and a steadfast commitment to advancing telecommunications solutions. With a focus on SaaS products, our team has successfully navigated the industry's evolution, ensuring that we remain at the forefront of technological advancements. My role encompasses not only the oversight of our direction but also the cultivation of a culture that values ethical standards and collaborative success.
Our achievements are anchored in a proven track record of delivering results and solving complex problems with efficiency. Spearheading business development and marketing initiatives, we have established a reputation for excellence within the telecom sector. The acquisition of TeleMessage by Smarsh in 2024 stands as a testament to our team's dedication and my leadership in driving growth and fostering a united vision."
The less charitable one is that Moxie was the opinionated and uncompromising core of the Signal Foundation and has been removed from the board and completely vanished from the public eye. What it stands for now is a touch less clear.
This mess is entirely the fault of Telemessage and the people who chose to use it for top-secret comms.
How is Molly doing these days? Is there an alternative server you could selfhost?
https://smarsh.my.salesforce.com/sfc/p/#30000001FgxH/a/Pb000...
Anedote: in Wall Street, Global Relay and TeleMessage are the major players when it comes to achieving communication for compliance.
Yeah I'm normally a big proponent of responsible disclosure, but in this case, I think the more painful, damaging leak is required.
Firstly, autocrats, fascists & oligarchs don't care that much if you hack them. They will just keep using these tools (or another one just like it) ignoring the correct procedure their government already wants them to use. The citizens of affected nations need to be made angry by their leaders' failure to do their jobs correctly, and that's only gonna happen when there are consequences for their actions. Their incompetence put their nations at risk, and now it's clear they have failed to keep their intel safe. They have failed hard, let them fail hard.
Second, journalists and researchers have almost completely lost their power. In a non-democratic world (we're nearly there, just give them a little more time), when a journalist exposes corruption or incompetency, that journalist/researcher is simply silenced by the government. Silence the journalists and nobody knows what's going on so oppression can continue unchecked. Every person who gets silenced has a greater chilling effect on the whole society; nobody wants to be next. This is how authoritarians gain power. Oppression with no resistance or consequence legitimizes the oppression.
If we were just talking about typical corporate incompetence re: security, and the only thing at stake is a single stock or individuals' data, I would say disclose responsibly. But when it comes to stopping autocracy, the gloves have to come off. They sure as shit aren't gonna play by any rules, so neither should we.
This is a really dangerous line of thinking. It's the line of thought that slides forwards to "I love America so much, but to save America I have to get Americans to really feel the pain, and to do that I need to <horrible violence> to them to wake them up and make them see how things are bad."
Hurting people in order to make them see how they are being hurt is almost never the right call.
Lying to people in order to make them never see how they are being hurt is almost never the right call.
There is a lot of daylight between dropping a bunch of texts for government officials and committing horrible violence against people as a whole! These are not the same thing! One could be good/fine while the other is bad!
Having said that I would worry for a WikiLeaks-style "oh now this random person's info is out there because it was in one of these e-mails".
I just want to see the gossip
Especially in conditions when you don't have to lie at that.
It's not because voters are so gullible that they are ready to believe any word of a charismatic leader. The loss of trust to the mainstream media and to the scientific community is a natural phenomenon in environment when they only tell lies to push their political agenda.
The consequences likely wouldn’t be felt by those leaders though. Who knows what info is in those logs about informants, agents etc etc. Leak it openly and they’re dead.
We had the Cabinet Leaks in Aus https://www.abc.net.au/news/2018-01-31/cabinet-files-reveal-...
The national broadcaster picked 2 things to report on, then gave the rest of it back to the government.
The act of helping cover this shit up likely changed the course of politics in this country for decades. Theres likely stuff in that cabinet that was well in the public interest and needed disclosure.
Signalgate or whatever is likely the same. And I dont care which party it harms or whatever. It seems relevant that people should have more information, not less considering everything that is happening.
We get you think they're "fascists" or whatever. The majority of the country does not. If you inform your ethical decision-making on this basis expect the majority of the country to oppose you and view you as a criminal.
I don't find your post-hoc justification for contravening what are generally considered ethical standards particularly interesting. If your position is that what you judge to be "autocracy" enables minimally discriminate hacking and leaking of information then expect the right to do the same to kamabla if she ever takes office.
No comments yet
- Pete Hegseth
That line simultaneously becomes funnier and more depressing.
Is this group not very seriously discredited, with ties to FBI, convicted child porn criminals, etc? Or am I getting something mixed up?
This could still be a legitimate leak, of course. I'm just wondering if this info is publically known, or if I'm conflating things
Unfortunately, the financial structure doesn't really make it easy for custom DoD software.