33 votes

A Signal update fends off a phishing technique used in Russian espionage

6 comments

  1. skybrian
    Link
    ... ...

    Russia-linked groups [...] are taking advantage of a Signal feature that allows users to join a Signal group by scanning a QR code from their phone. By sending phishing messages to victims, often over Signal itself, both hacker groups have spoofed those group invites in the form of QR codes that instead hide javascript commands that link the victim's phone to a new device—in this case, one in the hands of an eavesdropper who can then read every message the target sends or receives.

    ...

    Two months ago, Google began warning the Signal Foundation that maintains the private communications platform about Russia's use of the QR code phishing technique, and Signal last week finished rolling out an update for iOS and Android designed to counter the trick. The new safeguard warns users when they link a new device and checks with them again at a randomized interval a few hours after that device is added to confirm that they still want to share all messages with it. Signal now also requires a form of authentication such as entering a passcode or using FaceID or TouchID on iOS to add a new linked device.

    In fact, Signal had already been working to update those forms of phishing protections aimed specifically at exploitation of its linked device feature prior to Google's warning, says Signal's senior technologist, Josh Lund. But Google's report about Russia's spying in Ukraine provided an “acute” example of the problem that pushed them to move quickly to protect users, he says.

    ...

    Both Google and Signal emphasized that the phishing technique Google has seen in use in Ukraine doesn't suggest that Signal's encryption is broken or that the app's messages can otherwise be eavesdropped in transit. Instead, the trick essentially combines two legitimate features—QR-code group invites and QR-code device linking that pairs a smartphone with a laptop—invisibly swapping one with the other to deceive users.

    12 votes
  2. [4]
    kingofsnake
    Link
    Who donates to Signal? On another note, how robust is Signal's financial backing? It's punching above its weight these days, but as we've learned, it's not easy or cheap to go up against big tech.

    Who donates to Signal?

    On another note, how robust is Signal's financial backing? It's punching above its weight these days, but as we've learned, it's not easy or cheap to go up against big tech.

    4 votes
    1. [2]
      ewintr
      Link Parent
      I donate 5 euros a month. It does not sound like much, but I make it a point that a monthly small donation is better than one big one around Christmas when we all feel sentimental. I started a...

      Who donates to Signal?

      I donate 5 euros a month. It does not sound like much, but I make it a point that a monthly small donation is better than one big one around Christmas when we all feel sentimental. I started a couple of years ago, not sure exactly when.

      I have several of those donations running. It does add up, but there are so many good projects that I want to support. My rule is: I am in a more fortunate position than most. If there is a project that is normally free, but I use it because of ideological reasons, then I should donate a reasonable amount each month for my usage to help keep it free for everyone. That goes for something essential like safe and private messaging, but equally so for a radio station like somafm.

      My actions won't tip the scale. I am just an individual. Whether Signal goes bankrupt or not is completely outside my control. But I believe it is still the right thing to do.

      12 votes
      1. kingofsnake
        Link Parent
        Good call. I donate plenty as well, and something like this deserves billing. I'll start mine too.

        Good call. I donate plenty as well, and something like this deserves billing. I'll start mine too.

        1 vote
    2. norb
      Link Parent
      Weirdly I just set up a $5 a month donation to them today. Mainly for similar reasons as u/ewintr stated.

      Weirdly I just set up a $5 a month donation to them today.

      Mainly for similar reasons as u/ewintr stated.

      4 votes