Security Concerns Surround TeleMessage Signal’s Archiving Feature

The communication application TeleMessage Signal, reportedly utilized by at least one high-profile official during the Trump administration, has faced significant scrutiny following recent security breaches. These incidents have led to a temporary halt in services as the company investigates potential vulnerabilities.

Findings from Security Researcher Micah Lee

Micah Lee, a journalist and security researcher, conducted an in-depth examination of TM Signal’s Android source code, revealing fundamental security flaws. Previous analyses highlighted that the service had already been compromised, exposing user messages and data. This raised alarms about the security assertions made by TeleMessage, which claimed that TM Signal offered “End-to-End encryption from the mobile phone through to the corporate archive.” However, Lee’s latest investigation indicates that communications within TM Signal are not end-to-end encrypted, allowing TeleMessage access to user conversations.

Technical Analysis and Concerns

Lee stated, “The fact that there are plaintext logs confirms my hypothesis. The security practices at TM Signal were worse than I expected, particularly the ease with which the archive server was compromised.” His analysis confirmed that message data is stored on the user’s device and then sent to TeleMessage’s archive server in plaintext, undermining the alleged security of the app.

Implications for Users

This revelation holds critical implications, particularly for government users, including figures like Mike Waltz, former national security adviser, who were photographed using the app during official meetings. TM Signal’s compatibility with the legitimate Signal app could further risk exposing messages sent during communications involving both platforms.

TeleMessage’s Background and Response

TeleMessage, an Israeli company that was acquired by the US-based firm Smarsh last year, serves as a federal contractor. However, its consumer applications are not approved under the Federal Risk and Authorization Management Program (FedRAMP), which casts further doubt on their security protocols. In response to recent breaches, Smarsh announced an ongoing investigation, stating that they engaged external cybersecurity experts to assist.

Government Reaction and Call for Investigation

U.S. Senator Ron Wyden has called for an investigation by the Department of Justice, expressing concern that the use of TeleMessage Archiver presents serious national security risks. In a letter, he stated, “The government agencies that have adopted TeleMessage Archiver have chosen the worst possible option… they have given their users something that looks and feels like Signal, but instead, senior government officials have been provided with a shoddy Signal knockoff that poses a number of serious security and counterintelligence threats.”

Conclusion

In light of these findings, users of TeleMessage Signal, particularly within governmental organizations, are urged to reassess their reliance on this communication tool. The ongoing investigation will hopefully shed more light on the app’s security architecture and prompt necessary reforms to restore user trust.