Russian Hackers Exploit Signal Backup Keys Warns FBI

The FBI and CISA have issued an urgent warning about a sophisticated phishing campaign orchestrated by Russian intelligence services targeting Signal messaging app users. The attackers are specifically pursuing Signal backup recovery keys, which grant them persistent and comprehensive access to victims' entire message histories. What makes this threat particularly insidious is that once hackers obtain a recovery key, they maintain access even after the victim changes phones or devices.

The campaign, attributed to Russian intelligence groups including FSB Border Guards and Russian military operatives tracked as UNC5792 and UNC4221, targets high-value individuals. These include current and former government officials from the US and abroad, military personnel, political figures, journalists, and Ukrainian officials. The broader operation has already compromised thousands of accounts globally, affecting both Signal and WhatsApp users, though the recovery key exploitation technique is unique to Signal.

The attack methodology relies entirely on social engineering rather than breaking Signal's encryption. Hackers pose as Signal support staff, sending convincing messages within the app itself that request backup recovery keys, verification codes, or account PINs. Recent phishing messages masquerade as mandatory two-factor authentication updates or urgent data recovery warnings, manipulating users into enabling backups and surrendering their recovery keys. Earlier versions employed doctored group invite links that secretly linked attackers' devices to victims' accounts.

The critical vulnerability lies not in Signal's encryption or security architecture, but in human trust. Once a recovery key is compromised, attackers can restore account backups, read all private and group messages, and commandeer the account completely. Even creating a new account on the same phone number doesn't revoke the old key's access to future backups. The only remedy is generating a new recovery key through Signal's settings, which invalidates the compromised key prospectively but cannot undo any data already extracted.

Security agencies emphasise that Signal never messages users within the app requesting credentials or recovery information. Any such message should be treated as hostile regardless of how legitimate it appears. The US State Department is offering up to £8 million for information on UNC5792, reflecting the severity of this ongoing threat. This campaign underscores a fundamental security principle: end-to-end encryption protects data in transit, but cannot defend against users who are deceived into voluntarily surrendering their own security credentials.

Fuente Original: https://thenextweb.com/news/fbi-russian-hackers-signal-backup-recovery-key-unc5792

Artículos relacionados de LaRebelión:

• Linux Exploit Pwned Root Access via Poisoned Binaries
• Exploit Imparcheable usbliter8 Compromete Chips Apple A12-A13
• Nadella Warns AI Could Hollow Out Industries
• Hackers Chinos Diez Anos Ocultos en Linux
• AI Pause Anthropic Warns of Self-Improving Risks

Artículo generado mediante LaRebelionBOT

Main Technology Tendencies in 2024

Introduction

As we delve deeper into the digital era, technology continues to evolve at a brisk pace, shaping our lives in unprecedented ways. In this blog post, we will explore three key technology trends that are set to dominate the landscape in 2024.

Artificial Intelligence (AI)

Artificial Intelligence continues to be a key trend in technology. In 2024, we will see more refined and sophisticated AI models, capable of performing complex tasks with minimal human intervention. Machine learning algorithms will be enhanced, leading to more precise predictions and decisions. AI is projected to permeate various industries, from healthcare, where it will assist doctors in diagnosing diseases, to the automotive industry, where it will drive the expansion of self-driving cars.

Internet of Things (IoT)

The Internet of Things (IoT) is another significant trend to watch out for in 2024. IoT refers to the network of physical objects embedded with sensors, software, and other technologies for the purpose of connecting and exchanging data with other devices and systems over the internet. These connected devices will become increasingly prevalent in our daily lives, from smart home appliances that sync with our smartphones to industrial IoT that improves manufacturing processes. The IoT industry will continue to grow, driven by the increasing need for automation and data-driven decision making.

Quantum Computing

Quantum computing, although still in its early stages, is set to make significant strides by 2024. Leveraging the principles of quantum physics, quantum computers can process data at a speed that is exponentially faster than traditional computers. This technology has the potential to revolutionize various fields, including cryptography, logistics, and drug discovery, by solving problems that are currently beyond the reach of classical computers.

Conclusion

In 2024, technology will continue to evolve and influence various aspects of our lives. From AI to IoT to quantum computing, these trends signify the dawn of a new era of innovation and disruption. As we move forward, it is essential for businesses and individuals to stay abreast of these trends and adapt accordingly to thrive in the ever-changing digital landscape.

Backup de seguridad de tu máquina Linux

En estos días de confinamiento, me he decidido a ordenar un poco mis máquinas, en mi caso, cuento con tres raspberry en casa con diferentes distribuciones de Linux que utilizo para montar labs de sistemas, de programación, bases de datos como MariaDB o PostgreSQL e incluso cosas de seguridad o hardening.

Las raspberry, por la experiencia que tengo ya con ellas de varios años pueden sufrir problemas con la tarjeta SD y dejarte tirado. Como me ha pasado ya varias veces, me he decidido por escribir un script en shell para salvaguardar la información. Hasta aquí, todo más o menos sencillo, el problema es... ¿donde lo almaceno?.

Gracias a mi hermano, he descubierto http://mega.nz, se trata de una nueva startup del reputado empresario Kim_Dotcom, el creador de Megaupload. Lo primero que recomiendo hacer es crearte una cuenta gratuita de Meganz (50GB gratis).

Una vez la crees, descargate el componente para utilizar via json la integración con el API de meganz, el componente se llama Megacmd

Una vez que ya tengas todo esto instalado en tu máquina, ya puedes personalizar este pequeño shell script y almacenar tus backups en la nube.

#!/bin/bash

NAME=`hostname`
LIMITSIZE=5485760 # 5G = 10*1024*1024k   # limit size in GB   (FLOOR QUOTA)
MAILCMD=mail
R=/home/xxxx/src
LOG=$R/log/log-$(basename ${0}).log
EMAILIDS="user@domain.net"
MAILMESSAGE=$R/log/tmp-$(basename ${0})

if [ -d /media/4TB ]
then
        ROOTPATH=/media/4TB/servers/$NAME  # in case we've mount volume
        MOUNTP=/media/4TB
else
        ROOTPATH=/opt/$NAME  # in case no
        MOUNTP=/
fi

BKDIR=$ROOTPATH/bkdir # simple text file for to list your directories for backup, normally /etc /home/user /root /var/www/html ...
BKPATH=$ROOTPATH/backup
FREE=$(df -k --output=avail "$MOUNTP" | tail -n1) # df -k not df -h because is more exact

if [ ! -d $BKPATH ]
then
        mkdir -p $BKPATH
fi

if [ ! -d $R/log ]
then
        mkdir -p $R/log
fi

email_on_failure () # functions for launch email alert
{

          sMess="$1"
          echo "" >$MAILMESSAGE
          echo "Hostname: $(hostname)" >>$MAILMESSAGE
          echo "Date & Time: $(date)" >>$MAILMESSAGE

          # Email letter formation here:
          echo -e "\n[ $(date +%Y%m%d_%H%M%S%Z) ] Current Status:\n\n" >>$MAILMESSAGE
          cat $sMess >>$MAILMESSAGE

          echo "" >>$MAILMESSAGE
          echo "*** This email generated by $(basename $0) shell script ***" >>$MAILMESSAGE
          echo "*** Please don't reply this email, this is just notification email ***" >>$MAILMESSAGE

          # sending email (need to have an email client set up or sendmail)
          $MAILCMD -s "Urgent MAIL Alert For $(hostname) Server" "$EMAILIDS" < $MAILMESSAGE

          [ -f $MAILMESSAGE ] && rm -f $MAILMESSAGE
}

if [ "$FREE" -lt "$LIMITSIZE" ]
then
          echo "Writing to $LOG"
          echo "MAIL ERROR: Less than $((($FREE/1000))) MB free (QUOTA) on $MOUNTP!" | tee ${LOG}
          echo -e "\nPotential Files To Delete:" | tee -a ${LOG}
          find $MOUNTP -xdev -type f -size +500M -exec du -sh {} ';' | sort -rh | head -n20 | tee -a ${LOG}
          email_on_failure ${LOG}
else
   echo "Currently $((($FREE-$LIMITSIZE)/1000))) MB of QUOTA available of on $MOUNTP. " 
fi

if [ ! -f $BKDIR ]
then
        echo "Doesn't exist bkdir file. Aborting!" 
        exit 1
else
        filename=$NAME"_daily_backup_""$(date +'%Y_%m_%d')".tar.gz
        logfile="$R/"log/backup_log_"$(date +'%Y_%m')".log

        # Packages installed on Linux

        dpkg-query -W -f='${Installed-Size} ${Package}\n' | sort -n > $BKPATH/packages_installed.txt

        # Compressing my directories

        tar czf $BKPATH/$filename -T $BKDIR
        echo "dumping source code finished at $(date +'%d-%m-%Y %H:%M:%S')" >> "$logfile"

        # Changing permission

        chown root -R "$BKPATH"
        chown root "$logfile"
        chmod 644 $BKDIR
        chmod 600 $ROOTPATH

        echo "file permission changed" >> "$logfile"

        # removing old files and temporary files

        find "$BKPATH" -name "*daily_backup*" -mtime +3 -exec rm {} \;
        echo "old files deleted" >> "$logfile"
        echo "operation finished at $(date +'%d-%m-%Y %H:%M:%S')" >> "$logfile"

        # pushing mega.nz

        mega-login user@domain.net password
        mega-sync $BKPATH $NAME
        echo "pushing backup to mega.nz $(date +'%d-%m-%Y %H:%M:%S')" >> "$logfile"
        echo "*****************" >> "$logfile"
        exit 0
fi