The Trump Admin's Signal Clone Was Hacked

0:00In today's world, data breaches happen all the time. And even the most secure companies can't always protect their employees' personal information from ending up in the wrong hands. That's where Delete.me comes in. Delete.me is a service that removes your employees' sensitive information from hundreds of data broker websites. Sites where hackers can find phone numbers and emails within seconds. Rachel Toback, CEO of Social Proof Security, says attackers use this data to target employees with phishing messages and AI-powered phone scams. but Delete Me makes it harder for these bad actors by scrubbing your employees' details regularly.

0:38It's simple. Attackers are lazy. If it's too hard to find contact info, they'll move on to easier targets. Delete Me takes care of this for you, doing the heavy lifting so you don't have to. And over time, they keep removing the information so it stays down, protecting your team from constant exposure. If your business has a social presence or deals with clients, you need DeleteMe. Visit deleteme.com slash 404media and start safeguarding your team's information today. That's deleteme.com slash 404media.

1:17Hello, welcome to the 404media podcast, where we bring you unparalleled access to hidden worlds, both online and IRL. 404media is a journalist-founded company and needs your support. To subscribe, go to 404media.co. As well as bonus content every single week, subscribers also get access to additional episodes where we respond to their best comments. Getting access to that content at 404media.co. I'm your host, Joseph. And with me are 404 Media co-founders, Sam Cole. Hello. Emmanuel Mayberg. Hello. And Jason Kebler. What's up? I don't think we have anything to announce. so Emmanuel do you want to take us into this first story yeah our first story today the headline is the signal the signal clone the Trump admin uses was hacked um this is a collaboration between Joseph and Michael Lee before I get to these questions Joe how would you uh how would you describe Michael Lee other than a collaborator and a friend of the site uh I would say Michael Lee is a very accomplished technologist and journalist.

2:26He used to work at the, um, the intercept, uh, and working with a lot of hacks and leaked data and that sort of thing. And that's where I first knew about his work. Uh, and then he actually published a book, which is very, very useful. I'm actually going to bring up now the art of analyzing hacked data, hacked and leaked data and i mean it's phenomenal i need to go back and work through more of it but it provides journalists like all of these different scripts and guides on how to analyze leaked information so he's very very experienced in this world you know in the same way we are uh we're very experienced in verifying data but he brings a much more um technical frame of mind to all you know, and technical expertise for sure.

3:17Yeah, it was really nice working with him. Hopefully we can have him on the pod at some point. So last week, you discovered via an image that Reuters took that the Trump admin was using a signal clone to communicate. And this was made by a company called TeleMessage. What is TeleMessage and how do we know about it? Yeah, when I zoomed into the photo and i think some other people did on blue sky and they were like oh look they're using signal when i looked at i was like huh there's something odd about that and it said something like verify tm signal pin uh and then that's how we determined there was actually a different version of signal and what this is at least i'll do it i'll explain in the way the telemessage explains it which is that this is an ordinary version of signal a complete copy except it does one thing, which is archive your messages, right?

4:15And they say they do that securely. And the idea is that, well, if you're a government agency, you need to keep copies of messages for record keeping purposes, for legal reasons as well. And maybe if you work in a regulated industry like finance or something, cryptocurrency, that sort of thing, you probably need to keep records of messages as well, you know, under SEC regulations and that sort of thing. So the idea is that it provides a secure way to chat while also meeting those archiving requirements. So we were already having kind of a busy weekend, but then this blew up on Sunday. What happened on Sunday?

4:59Yeah, on Sunday, Micah reached out to us, and then me and you spoke about this. And basically, what happened was a hacker had managed to breach telemessage in some sort of way. And we didn't have all of the specifics immediately. That only became clearer later. But Micah put us in touch with the hacker and provided information that this person had provided. And I think we'll talk about what was hacked and all of that sort of stuff in a minute. But it was immediately clear from seeing the screenshots, some of which we published redacted versions of in the article itself, that this looked pretty serious.

5:50And as the headline says, and just really to put a pin on it, the app that at least some members of the Trump administration are using, And in that Reuters photo, Mike Waltz, it appears he's speaking or has chats with J.D. Vance, Tulsi Gabbard, and Marco Rubio as well. Obviously, all incredibly senior members of the Trump administration. Those conversations potentially, or at least people in the Trump administration, are using an app which now, it seems, has been hacked, which changed our weekend plans. Yeah. So you talked to this hacker. What are they saying? What are they showing us that makes this seem like big news?

6:36Yeah, so they told me how they did it. And in the article, we don't go into a great amount of detail about that because at the time we were very concerned that maybe somebody else could reproduce this or go hack telemessage in the same sort of way. as we'll probably get to that's less of a concern now because telemessage has basically suspended operations in response to all of this but the hacker said it took them i don't know 15 to 20 minutes to actually perform this hack which i know on on one side it's like time doesn't really matter for hacking i mean it's a computer it's instantaneous like what does that even mean on the other what the hack is really referring to is probing the servers and systems and trying to figure out um what's an issue here and that's actually a much more human process than it is like a tool driven one or an automated one yeah they said it was very very quick and then they provided a couple of things first were these screenshots of a tele message back end and one showed um a bunch of contact details for customs and border protection officials um there was some Coinbase ones as well.

7:56And then what look to be messages sent between people using the telemessage service, it seems. That's the high level, anyway. Yeah, just in terms of the 15 to 20 minutes, I think a good comparison is sometimes we talk about iOS zero days, and that's a situation where countless people of the highest level of skill in terms of pen testing and hacking are constantly trying to find vulnerabilities. So I don't know if you can put a number on it, but it's just like many, many, many, many, many hours of trying to find a vulnerability. This is not that. This is someone saying like, oh, look at this thing that is in the news that seems important.

8:45I'm just going to poke around. And they poked around for 15 minutes and it was not secure. So what do we know about the actual vulnerability and what more did we see in the hack materials? Yeah. Micah did a really good way of phrasing, because of course the balance here is that Micah Lee is very, very technically minded, but they're also very, very good at writing for a general audience. And I appreciate that and we took that and uh maybe we broadened it i can't quite remember but basically we we all landed on describing the data as sort of snapshots as in this was snapshots of data telemessage data going across the server that the hacker through this vulnerability which we're not going to really explain um was managed to lift those essentially and to us it was almost like kind of random what data they got potentially but what they did get were these series of messages and group chats and i'll just say straight away like we don't know the identity of the hacker and we don't think they have you know mike waltz's signal group chats or anything like that um but seeing a signal group chat from this app is obviously highly, highly concerning.

10:14Jason, you actually looked a bit more in-depth into one of the messages. You came into the article and then you kind of pulled out this signal message. What was that one and why was that interesting to you? Yeah, I mean, it was super interesting. It came ostensibly from this company called Galaxy Digital, which is a massive crypto VC firm, I believe. notably did some stuff with Vice back when we were there that we weren't involved in. We weren't involved with it in any way, but they were basically... They've been around for a long time and one of the things that they do is they try to make crypto more mainstream and normalized.

10:57They're very interested in stablecoins and in making sure that crypto is not overly regulated, but is treated sort of like other investments by the government. And so there's currently this really important stablecoin bill called the Genius Act that is before the Senate right now. And so they're trying to get 60 senators to vote on it. And there are messages. This one said, quote, need seven Dems to get to 60 would be very close. And then another one said, just spoke to a D staffer on the Senate side, so Democratic staffer on the Senate side, two co-sponsors, also Brooks, Angela also Brooks, and then Kirsten Gillibrand, who that's the Maryland senator and the New York senator, both Democrats, quote, did not sign the opposition letter.

11:57So they think the spill still has a good chance of passage of the Senate with five more D's supporting it. There's some typos in there that I just tried to read. But essentially, this was them talking about this bill that is really important right now for this company that has had a lot of news coverage about it, a lot of hype on Capitol Hill. And they're talking about behind-the-scenes machinations of trying to get this bill passed. And so pretty wild. This is a peek into the legislative process in DC. We don't know exactly who said what or what's going on here, but it just goes to show that the types of information being shared on Signal via the telemessage app is really sensitive, potentially very sensitive.

12:51So what are the implications of this, given Jason's example and other examples that we've seen? Yeah. Well, I think the main one is that these messages are seemingly not as secure as telemessage has claimed or would probably like some people to believe. So we first broke news of Mike Waltz using this tool, and then there was various pieces of media coverage after that. One was a New York Times piece that talked about the potential security risks, right? And they have a quote from the president of Smash's enterprise business. That's the company that owns TeleMessage. And they said, we do not de-encrypt, which is a very weird term, obviously, but the implication being that, well, we take the messages that are encrypted and then we archive them.

13:43We're not like, you know, unencrypting them, then re-encrypting or doing something like that. Basically, they are saying or suggesting that the messages are secure well i think that that doesn't really square with the fact that we have a screenshot that is showing a signal message basically i don't think you can really combine those together um so that's you know obviously the first major thing that messages going across the service are not being properly secured then from there it balloons out to again as far as we You know, the hacker doesn't have Mike Waltz's messages or anything like that.

14:24But it does bring up the idea of, well, could other people's messages have been exposed, not necessarily to this hacker, but to someone else? Because these very senior officials were using the app. And then I think almost maybe the final thing is that if this hacker can identify this issue and exploit it in 15 to 20 minutes, what can a foreign adversarial intelligence agency like China or Russia or Iran do with the knowledge that the US government uses telemessage and this company seemingly has serious, serious security issues? It's answered a bunch of questions. It's shown that there is not theoretical risk here.

15:12It is really, really real and tangible. But now it brings up even more questions as well, almost. Yeah, I mean, we don't have any evidence to suggest that anyone else knew about this vulnerability before our story, before this hacker found it. But I don't know, if a hacker found it in 15 minutes, are we to assume that no state actor ever tried poking around here or doesn't know that the government uses this or other corporations use it? It's what makes the story really scary. Joe, just to like, I'm sorry to make you play like armchair CSO for a second, but I'm not deep in the weeds on this type of security and privacy stuff.

15:56And when you filed your first story last week, I just looked at TeleMessage's website. And it sort of inherently doesn't make sense, even with what little I know about security. if you're an organization that wants to communicate securely over messaging but also for legal reasons has to keep a record of all those messages how would you do this like does this seem like a sensible way to do this is there a better way to do this do you think um it's really really hard because i think kind of what you suggest is that introducing a third party to a chat like this which is supposed to be a chat between two signal users or two whatsapp users or whatever adding a third party to that be be that another person be that a phone that's been affected by malware or in this case a server that's archiving messages that inherently introduces some sort of risk that being said the risk is going to be different depending on the implementation, right?

17:05Let's say that the service that's archiving the messages is part of that group chat, so it has the content and then it passes it to a server securely, which also has the key, which then decrypts it. So whenever it's moving from place to place, it's still encrypted. That's a very, very general sort of explanation or diagram of it. But, you know, that could be one way to do it. Or maybe this is a better way of doing it. There are probably better ways to do it than what TeleMessage did, which is somehow letting the plain text of the signal message go across the server. But yeah, inherently, there is a problem here.

17:45Absolutely. I think, I mean, you brought this up, and it's like we don't have any evidence that Mike Waltz's messages were stolen. Like, make that very clear. but like this is what a hacker was able to steal in a few minutes and so I think that that is like we can't say for certain that this couldn't have been like way worse and that with that a better hacker or sorry like someone who wanted to cause more damage than this hacker did could have done something much worse than this like they were in there for not that long and they got quite interesting stuff. I mean, I just... I can't help but think that this is monumental fuck-up.

18:33This is a really, really bad hack. And I don't want to minimize it by just saying, oh, we don't have evidence that anything serious was taken because something very serious easily could have been. Just on that monumental fuck-up idea, uh i think the account swift on security shared this the other day but it was like a cnn article from 2014 where the person who worked on obama's blackberry like spoke at defcon or something and they were talking and i read it i was like wow i don't think i've ever seen this and it's discussing the time from you know when obama comes into power and he's like i really really want this blackberry and the NSA has to go away and figure out a way to do it more securely so the president at the time can communicate with various people on this device of choice.

19:27And that was like a massive pain in the ass, it seems, from everything in that article. They had to design additions or modifications. They had to implement it. And it took months and months and months to be able to do that. And then you compare that to what's going on here. And we don't know exactly the procurement process of telemessage. Sure looks like they just bought this tool, which is now doing this crazy insecure stuff. And I don't know, I don't even if I really want to make a broader point about, you know, systemic approach to security is definitely not how it was in previous administrations.

20:10Well, we were talking about this amongst ourselves, where it's like, they ostensibly have tele-message because the government has retention rules and banks have retention rules for compliance purposes and things like that. But as you said, it flies in the face of how this very secure messaging app is designed. It's undermining that, at least has the potential to undermine that type of security because you're making copies of the messages and putting them somewhere. And it's just like, I guess it sort of speaks to the fact that government workers, they're just like us. I hate to say where it's like, they don't want to do all of their communication in a skiff, in person.

20:57They are trying to talk to each other over regular messaging apps on their phone. and it just runs in the face of the type of security that you would ideally hope for for highly sensitive information. It's just like there's not a good way, at least that I know of, to archive this stuff with a third party in the cloud without adding additional attack surface. Emmanuel and I were just shooting this shit and I'll say it, I think it's like, I'm curious what people think, but it's like, you can archive it on the phone and then have the government workers turn in their phones at some point and forbid them from using disappearing messages or something like that.

21:50But it's just like, I don't see how security set up like this where you're just like making copies and having them be transmitted to a third party service that is not operated by the government is a good security design. To be clear, we've said it in the copy many times. I think we said it on the podcast already, but Signal has nothing to do with this fuck up. But I do think there's an element here of the Signal brand being so strong and being the default secure messaging app that whoever did the procurement was like, we need to have Signal, but we also need to archive everything. So let's turn to this solution, which is what would come up if you were looking for something like that.

22:34But it completely undermines the point of Signal and the reason that it is the gold standard for end-to-end encryption and messaging. It's very interesting to me that this app even works with Signal. And I guess that's just because it's an open source piece of software. But it's interesting to me that this can work with Signal, that you can essentially clone or fork signal. I don't want to get too speculative or out over my skis and talk about stuff I don't know anything about. But it is surprising to me that it's just a different client that is interoperable with Signal. I was surprised to learn that when you first reported it last week, Joseph.

23:22Sorry. So just to establish what a big fuck-up it is, I think a lot of that was made clear by looking at what happened after we published this story. Joe, do you want to go through some of the impact we've already seen? Yeah. So first of all, NBC News actually followed up with a report on Monday, and they said that another hacker had also managed to get into TeleMessage's system. and it sounds like they got the same information about queen base employees that we got that was another piece of contact information in there uh and potentially some other stuff as well but nbc didn't go into detail on that or maybe the hacker hadn't described at that point so another hacker got in basically um around this time telemessage suspends service um And we kind of saw the contours of this when their website suddenly became basically like a static page and you couldn't navigate to anything.

24:29It seems in the background that they had shut stuff down or something. And I actually got an internal customer FAQ that I was sent. And it's kind of hard to tell the timeline, but it was basically like, oh, you can still send messages, but the archiving is not working potentially. So there's a little bit of nuance there that I'm still looking into. um but the main thing is that senator ron wyden announced in a letter that was given to the washington post and then we wrote it up as well that he's demanding an investigation from the doj into this whole debacle and that includes the national security risk um the telemessage poses the counterintelligence risk and you know the potential israeli connection which I don't know it's kind of theoretical at this point you know and I'm not super in favor of being like oh well it's from this country or has some sort of connection to this country so xyz I don't know it kind of need to see the consequences of that afterwards that being said the security risks were very theoretical until they became very very real on Sunday night so you know I guess we'll see and whether this investigation goes anywhere i mean i don't know you know like in the previous administration or in other ones before that or even even like the first trump administration you'd be oh well they'll investigate you know i have no idea at this point i think what country doesn't matter so much as the fact that the administration knowingly was using a messaging app at the highest, most secure levels that is managed by a foreign company based in a foreign country with great interest into those messages that we now know they could have seen.

26:23So it doesn't, I think, really matter which country it is. It's a crazy thing to manage communication security in this way. yeah it would it would almost be it would still be a massive massive news story if the serve if the company was british or canadian or or any other of like the members of the five eyes alliance let alone one that's outside of that intelligence sharing alliance as well um all right should we leave that there um when we come back we're gonna talk about another hack it's been a very very crazy couple of days here. This is about the hack of an airline that's providing a ton of support to Trump's deportations.

27:09We'll be right back after this.

27:24Starting your own business is one of the biggest steps into the exciting unknown that you can take. It helps that proven experts help navigate that great unknown. For millions of businesses, Shopify is their guide, a tool that simplifies and supercharges your business. Shopify is the commerce platform behind millions of businesses around the world and 10 % of all e-commerce in the US, including 404 Media's own merch store. Setting up and managing our store couldn't have been easier thanks to Shopify's powerful, user-friendly interface. Get started with your own design studio. With hundreds of ready-to-use templates, Shopify helps you build a beautiful online store to match your brand's style.

28:03Get the word out like you have a marketing team behind you. Easily create email and social media campaigns wherever your customers are scrolling or strolling. And best yet, Shopify is your commerce expert with world-class expertise in everything from managing inventory to international shipping to processing returns and beyond. If you're ready to sell, you're ready for Shopify. Turn your big business idea into with Shopify on your side. Sign up for your$1 per month trial and start selling today at shopify.com slash media. Go to shopify.com slash media. Shopify.com slash media. The 404 Media Podcast is sponsored by BetterHelp.

28:46Tariffs are driving the cost of everything up and who knows what will happen next. Processing all of this can be tough, and it's made harder when there's stress on your finances. But the most secure type of investment you can make is an investment in yourself, with therapy. Traditional in-person therapy can cost between$100 and$250 per session. BetterHelp's online therapy can save you up to 50 % per session. With BetterHelp, you pay a flat fee for weekly sessions, saving you big and simplifying your budget. BetterHelp seeks to make therapy accessible, not a luxury. helping you get quality care at a price that makes sense.

29:21Talk therapy can help us process stress, anxiety, and an uncertain world. With over 30 ,000 therapists, BetterHelp is the world's largest online platform, having served over 5 million people globally. BetterHelp is fully online, making therapy affordable and convenient, serving over 5 million people worldwide. Easily switch therapists at any time, at no extra cost. Your well-being is worth it. Visit betterhelp.com slash 404media today to get 10 % off your first month. That's betterhelp.com slash 404media.

30:14to go independent. We were sick of working for a VC-backed company that put profits before journalism. That gave birth to 404 Media. Since then, we've stopped the spread of AI books in public libraries, triggered class-action lawsuits against AI companies, got Congress to pressure big tech in various ways, and we've even shut down surveillance companies. This real-world impact is only possible because of our paying subscribers. As a journalist-owned business, they are the engine that powers our journalism and where the vast, vast majority of our revenue comes from. So please consider signing up today for$10 a month or$100 a year at 404media.co slash membership and get bonus content every week and access to all of our articles.

31:02Thank you and enjoy the rest of the podcast.

31:18all right and we are back this is one that me and jason wrote the headline is global x airline for trump's deportations hacked i'll just very briefly explain what global exit is so there's a company called csi aviation and they get this big big contract from trump and ice basically to you know deport people or remove people and put them on flights and then that company in turn subcontracts with um a bunch of other um companies as well and one of those is global x air and i've actually been looking into them a little bit looking at flight data and i was actually preparing to write about them this week and then by pure coincidence a hacker reaches out to us and we believe other journalists unprompted and says they've stolen a bunch of this data.

32:24Jason, we're sent this data. I was sort of doing other things while I was writing this story. I was more talking to the hacker, asking about their motivation, looking at the defacement they put on. You were looking at the data. What do you see when you open it up exactly? Yeah, so it was a bunch of JSON files and text.txt files. And so JSON is database format, file format. And it's organized by day. And so there's a bunch of folders from January, February, March, which is important because a lot of these flights took place in March, a lot of the most important ones at least. And then April and May.

33:09So the data goes up until like three days ago, like pretty recent. And you open that up and it basically has flight data for each individual flight that GlobalX flew. And so the flight data includes the originating airport, the scheduled time, the plane flown, the number of passengers booked on the plane. I don't know if you'd say booked, but that's what they say. It's like the number of passengers on the plane. and then scheduled departure time, scheduled arrival time, etc., etc. And then for each of those, there's a passenger list as well. And so the passenger list includes a bunch of guards, so people who worked on the plane, and then the names of everyone who was on it.