Encrypted App Signal Preps New Changes To Counter Account Hijackings

Gaby Souza0
Encrypted App Signal Preps New Changes To Counter Account Hijackings
WhatsAppTwitterLinkedInFacebookEmailCopiar Link

The encrypted messaging app Signal is working on new security measures following reports that Russian state-sponsored hackers successfully hijacked as many as 300 user accounts in Germany. 

“In the coming weeks, you’ll see us rolling out a number of changes to help hinder these kinds of attacks,” Signal said in a tweet on Monday. 

Last week, news emerged that Russian hackers managed to hijack the accounts of several high-profile politicians in Germany, including the president of the country’s parliament. The hijackings affected at least 300 people in the country, according to the German news website Der Spiegel. 

Signal noted the encrypted messaging service wasn’t hacked. “Our encryption, infrastructure, and the integrity of the app’s code was not compromised,”  the nonprofit Signal Technology Foundation said. 

Instead, the suspected Russian hackers have been using phishing messages that impersonate “Signal Support.” Contacted victims assume the messages are legitimate, but are actually a trap to manipulate users into handing over the one-time authentication code, Signal PIN, and even the backup recovery key, which can then used to access the user’s Signal account on a second phone. 

European officials raised alarm bells about the threat last month, followed by the FBI. But it looks like the warnings haven’t been enough to stop the hackers. Josh Rogin, a global security analyst with The Washington Post, noted the same tactic has been successfully targeting human rights activists opposed to the Chinese government. 

For now, Signal was mum on how it’ll exactly counter the threat. The nonprofit noted that because Signal uses end-to-end encryption it can’t collect any user data to reveal more technical details about the phishing attacks. 

Still, Signal said: “While it’s true that all messaging platforms are susceptible to scammers and phishing that betrays people’s trust and convinces them to ‘unlock the front door’ where no backdoor exists, we are looking to do everything we can to help people avoid and detect such scams.”

“For the time being, please stay vigilant against phishing and account takeover attempts,” Signal added. “Remember that no one from Signal Support will ever send you a message request or ask for your registration verification code or Signal PIN.” 

A Signal support document also notes: “We do not initiate contact via in-app messages, phone calls, SMS, or social media. We communicate only via email with our official @signal.org handles.”

About Our Expert

Conteúdo Relacionados:
WhatsAppTwitterLinkedInFacebookEmailCopiar Link

Autor

  • Sou criador do MdroidTech, especialista em tecnologia, aplicativos, jogos e tendências do mundo digital. Com anos de experiência testando dispositivos e softwares, compartilha análises, tutoriais e notícias para ajudar usuários a aproveitarem ao máximo seus aparelhos. Apaixonado por inovação, mantém o compromisso de entregar conteúdo original, confiável e fácil de entender