Signal: user phone numbers in the wild (and it’s not the app’s fault)

Encrypted messaging service Signal announced this week that it had indirectly fallen victim to a phishing attack that exposed just under 2,000 of its users.

Signal may be one of the most secure instant messaging services on the market, but it is not immune to an attack by one of its collaborators. This is what happened a few days ago with a phishing attack that targeted Twilio, its verification service provider.

Signal attacked indirectly

Officialized on August 8 by Twilio, a specialist in two-factor identification, this attack exposed the phone numbers of nearly 1,900 Signal users, registered in a single compromised Signal account. In this case, the attacker would have succeeded in accessing the Twilio customer support console by a simple phishing.

As specified Neowin, the provider’s investigation revealed that of these 1,900 exposed numbers, the attacker explicitly searched for three of them. The user behind one of these three numbers had nevertheless already reported the incident to Signal, it reads.

Around 1,900 users affected

We learn anyway that Twilio has done what is necessary to put an end to the attack, while Signal for its part has begun to warn the holders of the 1,900 accounts potentially affected. The service has also withdrawn from the affected devices to limit the risks.

The risks are relatively limited. Indeed, the attacker did not have access to the message history, underlines Neowin, nor to users’ profile information or contact lists. All of this data is stored locally on the user’s device with no copies kept on Signal’s servers.

Source : Neowin