Data Leak Hits TeleMessage, a Customized Version of Signal

By Netvora Tech News

Researchers have discovered a data leak affecting TeleMessage, a customized version of the popular encrypted messaging app Signal. The leak was disclosed by researcher Micah Lee and 404 Media, who claim that TeleMessage contains serious vulnerabilities that allow an attacker to access archived chat messages from some users.

Vulnerable App Used by Government Officials

TeleMessage offers customized versions of Signal, WhatsApp, Telegram, and WeChat for archival purposes. Several US government officials have reportedly used TeleMessage, including US Security Adviser Mike Waltz, who inadvertently revealed his use of the software in a recent photo shoot. Reuters published a photo of Waltz, showing the app running in the background.

Data Leak Exposes Private Messages

According to Lee, the leaked data includes some private messages and group chats. However, he stressed that the exposed data does not belong to US government officials. Instead, it includes sensitive information from organizations such as the US Customs and Border Protection (CBP), cryptocurrency exchange Coinbase, and other financial institutions.

Attacker Gained Access to Debugging Data

404 Media reported that the attacker managed to access data stored by TeleMessage for debugging purposes. This data included parts of live, unencrypted data that was transmitted from TeleMessage's production server to be archived. TeleMessage has temporarily suspended its services.

Signal Warns Against Unofficial Customizations

In a statement to Security.NL, Signal emphasized that it cannot guarantee the privacy or security of unofficial Signal customizations like TeleMessage. The company emphasized the importance of using official Signal apps and warned users against using customized versions of the app.

TeleMessage's customized Signal app was found to contain serious vulnerabilities.
The app was used by several US government officials, including US Security Adviser Mike Waltz.
The leaked data included private messages and group chats from various organizations, including the US Customs and Border Protection (CBP) and Coinbase.
TeleMessage has temporarily suspended its services amid the data leak.
Signal warns against using unofficial customizations, emphasizing the importance of using official Signal apps.