Messaging app Signal at center of new Russian hack

Signal, the encrypted chat app, is currently the target of Russian hackers. This comes from a new Google security report, in which the company’s security experts detail “increasing efforts” from alleged Russian-backed “threat actors” to hack into Signal accounts.

The Google Threat Intelligence Group (GTIG) has been monitoring this for some time, pointing to the ongoing war in Ukraine as a primary reason. Due to its security, Ukrainian forces have opted to use Signal when communicating with each other, along with the general public.

Russian hackers will often employ social engineering to make their way into systems. Often these are through phishing campaigns, which Google details. In this case, group invites and QR codes are the culprits.

Dubbed “UNC5792” and “UNC4221” by GTIG, these groups are using Signal’s QR code invite system to gain access. Once scanned, the user expects to join a group for communication purposes. The hacking groups are embedding Javascript and other malicious code to pair the account to a new device, unlocking all the messages.

However, Signal is already pushing updates to counteract these attacks. The app will now warn users if their account is paired with a new device. It’ll also periodically remind them if they want to keep sharing access.

On iOS, Signal also now requires biometrics, like Face ID and Touch ID. Without these, the app simply won’t unlock for viewing, similar to how banking and password managers handle this kind of security.

Signal has become the almost de-facto standard for communicating privately. Journalists in almost every sector will use it for source communications, and as mentioned above, Ukraine is using it on the battlefield.

However, it’s not just Signal that’s being targeted. Meta’s WhatsApp and alternative messaging app, Telegram, are prime targets as well. All three apps are built on end-to-end encryption, making them excessively difficult to crack open in normal circumstances.

Outside of Russia and Ukraine, Elon Musk has begun to block Signal links on X (formerly Twitter), in what appears to be a method of suppressing whistleblowers.

Featured image: Signal, Pixabay

The post Messaging app Signal at center of new Russian hack appeared first on ReadWrite.