Post

We are aware of recent reports regarding targeted phishing attacks that have resulted in account takeovers of some Signal users, including government officials and journalists. We take this very seriously. 1/7

To be clear: Signal’s encryption and infrastructure have not been compromised and remain robust. These attacks were executed via sophisticated phishing campaigns, designed to trick users into sharing information – SMS codes and/or Signal PIN – to gain access to users’ accounts. 2/7

These attacks, like all phishing, rely on social engineering. Attackers impersonate trusted contacts or services (such as the non-existent “Signal Support Bot”) to trick victims into handing over their login credentials or other information. 3/7

To help prevent this, remember that your Signal SMS verification code is only ever needed when you are first signing up for the Signal app. To protect people from such phishing, Signal actively warns users against sharing their SMS code and PIN. 4/7

We also want to emphasize that Signal Support will *never* initiate contact via in-app messages, SMS, or social media to ask for your verification code or PIN. If anyone asks for any Signal related code, it is a scam. We make this clear when users receive their SMS code during initial signup. 5/7

In the meantime, please stay alert, and never share your SMS verification code or Signal PIN with anyone. 7/7 support.signal.org/hc/en-us/art...

Don't be afraid to call terrorists terrorists. Everyone understands which country is doing this.

You can even see it in the grammar of what they think is English.

We ran into this issue around the Munich Security Conference, followed by several layers of sophisticated attacks against U.S. Military systems. These attacks were followed by attacks in Amsterdam of a similar type against Counter Intelligence operations. Leading to major risk events.

And Kay. But every now and then I am asked to verify via pin. And this has been the case for a while. Do I respond or not?

I think you’re going to need to do more than that. This is a very human problem and you’re not going to mitigate it with interface design and sign posting. When has this ever worked in the last 50 years of computing?

Have Signal feed message content to AI to detect phishing? :-) More seriously, have the Signal app do a bit of keyword matching and throw up an often-false-alarm warning after hits?

Due to the way Signal is designed the first should be almost impossible for them to do, thankfully.