Signal Version Used In National Security Scandal Has Flaws - Cybersecurity Today

Summary

Cybersecurity Today: Detailed Summary of “Signal Version Used In National Security Scandal Has Flaws”

Podcast Information:

Title: Cybersecurity Today
Host/Author: Jim Love
Description: Updates on the latest cybersecurity threats to businesses, data breach disclosures, and how you can secure your firm in an increasingly risky time.
Episode: Signal Version Used In National Security Scandal Has Flaws
Release Date: May 5, 2025

Host for This Episode: David Shipley (sitting in for Jim Love)

Introduction

In the May 5, 2025 episode of Cybersecurity Today, host David Shipley delves into a series of significant cybersecurity incidents impacting major organizations and national security infrastructure. The episode covers a recent guilty plea by a notorious hacker, vulnerabilities in communication tools used by national security officials, critical flaws in widely-used Apple technology, and a massive data breach affecting millions of individuals.

1. Null Bulge Hacker Guilty Plea and Disney Data Theft

David Shipley opens the episode by discussing the conviction of a California-based hacker known by the alias Null Bulge. This individual, real name Ryan Kramer, admitted to unlawfully accessing Disney's internal Slack channels, resulting in the theft of over 1.1 terabytes of sensitive company data.

Key Details:
- Method of Operation: Kramer developed a malicious program disguised as an AI image generation tool, which he distributed via platforms like GitHub.
- Execution: A Disney employee inadvertently installed and executed the malware, allowing Kramer to harvest passwords from the employee's 1Password manager.
- Access and Theft: Using the compromised credentials, Kramer infiltrated Disney's Slack channels to extract data. [00:30]
Notable Quote:
- David Shipley: “Kramer then contacted the employee posing as a Russian hacktivist group called Null Bulge, warning that the personal information of the employee and Disney stolen Slack data would be published if the employee didn't cooperate.” [02:15]
Aftermath: The stolen data's release signaled the severity of the breach, and the FBI is currently tracing other victims who downloaded Kramer's malware.

2. TM Signal App Security Flaws in National Security Scandal

The discussion shifts to a scandal involving the use of an open-source Signal derivative, TM Signal, by former National Security Advisor Mike Waltz. This app, developed by Telemessage, purported to offer secure communication but harbored significant security vulnerabilities.

Security Concerns Identified:
- Hard-Coded Credentials: Micaiah Lee, an information security engineer, uncovered that TM Signal contained hard-coded credentials, a major security oversight. [03:45]
- Data Archiving: Unlike standard Signal communications, TM Signal automatically archived plain-text messages, including those meant to be ephemeral, potentially compromising sensitive information. [04:10]
- Source Code Vulnerabilities: Lee's access to TM Signal's source code revealed additional vulnerabilities that could be exploited by malicious actors. [04:30]
Impact on National Security:
- The use of TM Signal by high-ranking officials raised alarms about the potential for unauthorized data access and monitoring, undermining secure communications within national security frameworks. [05:00]
Notable Quote:
- Micaiah Lee: “The TM Signal app works by using Signal servers, making it possible for Waltz to send end-to-end encrypted messages to normal Signal users... however, unlike the Signal end-to-end encrypted conversation, TM Signal automatically archives a copy of the plain text messages.” [04:10]

3. AirPlay Vulnerabilities Exposed by Airborne Bugs

David Shipley highlights critical vulnerabilities discovered in Apple's AirPlay technology, known as the Airborne bugs. These flaws allow hackers on the same Wi-Fi network to execute malicious code on AirPlay-enabled devices.

Technical Breakdown:
- AirPlay Functionality: Enables seamless media streaming between Apple devices and third-party speakers, TVs, and other gadgets.
- Exploitation Method: Hackers can exploit Airborne bugs to infiltrate devices, spreading malicious code across the network with ease. [06:20]
- Affected Devices: Includes iPhones, iPads, Macs, and numerous third-party smart home devices that rarely receive updates, making them susceptible to prolonged exploitation. [06:50]
Risks and Implications:
- Network Spread: Once inside a network, attackers can move laterally, compromising multiple devices without immediate detection.
- Smart Home Vulnerabilities: The lack of regular updates for many smart devices exacerbates the risk, leaving numerous entry points for potential breaches. [07:30]
Recommendations:
- Patch Management: Users are urged to promptly update all Apple and third-party AirPlay-enabled devices to mitigate these vulnerabilities.
- Employee Education: Organizations should educate employees, especially those with privileged access, about securing smart home devices and maintaining robust cybersecurity hygiene. [08:10]
Notable Quote:
- David Shipley: “Airborne, and for those of you like me who had hoped for or thought we had moved past the era of branded vulnerabilities, is particularly dangerous because many smart home devices... are not regularly updated by owners or sometimes even by device makers.” [07:45]

4. Major Data Breach at Verisource Services

The episode proceeds to reveal a substantial data breach at Verisource Services, a Houston-based employee benefits administration provider. Initially reported in early 2024, the breach's true scale was only uncovered months later.

Breach Timeline:
- Detection: February 28, 2024 – Verisource identified unauthorized access disrupting system operations.
- Initial Disclosure: Initially reported to affect 1,382 individuals, including sensitive personal information such as Social Security numbers and protected health information (PHI). [09:00]
- Investigative Findings: Forensic analysis revealed that hackers had accessed and exfiltrated data on February 27, 2024, preceding the detection. [09:30]
Escalation of Impact:
- Expanded Scope: By August 2024, the breach's impact was reassessed to involve 112,000 individuals' PHI, and further investigations indicated up to 4 million affected individuals. [10:15]
- Regulatory Notifications: The breach was reported to the HHS Office for Civil Rights due to the involvement of HIPAA-regulated entities, with ongoing updates expected. [11:00]
Organizational Response:
- Delayed Reporting: The comprehensive data review concluded on April 17, 2025, revealing the breach's extensive reach, highlighting challenges in breach detection and reporting timelines. [11:30]
- Data Compromised: Information compromised includes names, dates of birth, genders, Social Security numbers, and PHI of both employees and clients' dependents. [10:00]
Notable Quote:
- David Shipley: “The data breach was initially reported as affecting 1,382 individuals, but as the investigation progressed it became clear the breach was far worse than initially thought and this is not uncommon.” [09:45]

Conclusion

In this episode of Cybersecurity Today, David Shipley sheds light on significant cybersecurity breaches and vulnerabilities that have far-reaching implications for businesses and national security. From the conviction of a hacker targeting Disney to vulnerabilities in communication tools used by top officials, and critical flaws in ubiquitous technologies like Apple's AirPlay, the episode underscores the ever-evolving landscape of cybersecurity threats. The massive data breach at Verisource Services further exemplifies the challenges organizations face in detecting and mitigating security incidents swiftly.

Key Takeaways:

Vigilance Against Malware: Organizations must enforce stringent software installation protocols to prevent malware infiltration.
Secure Communication Tools: Reliance on secure communication platforms requires thorough vetting to ensure they meet stringent security standards.
Regular Updates and Patch Management: Keeping all devices and software up-to-date is crucial in defending against known vulnerabilities.
Comprehensive Incident Response: Prompt detection, thorough investigation, and transparent reporting are essential in managing data breaches effectively.

For more insights and detailed discussions on the latest in cybersecurity, subscribe to Cybersecurity Today and stay informed about the threats and defenses shaping our digital world.

Transcript

David Shipley (0:01)

Hacker Null Bulge pleads guilty to stealing Disney's Slack data Open source version of Signal used by former National Security Advisor had hard coded credentials. Millions of Apple AirPlay enabled devices can be hacked via WI FI, and a 2024 Employee Benefits Administration provider breach is more than 3,000% larger than last reported, hitting 4 million Americans. This is Cybersecurity Today and I'm your host David Shipley. Bleeping Computer reports that a California man who used the alias Null Bulge pled guilty last week to illegally accessing Disney's internal Slack channels and stealing over 1.1 terabytes of internal company data. According to the US Department of Justice, a 25 year old named Ryan Kramer created a malicious program in early 2024 that was promoted as an AI image generation tool on GitHub and other platforms. However, the DOJ says this program was actually malware that allowed Kramer to access the computers of those who installed it in order to steal data and passwords from those devices. According to the Wall Street Journal, a Disney employee downloaded and executed the malware on his computer. This gave Kramer access to passwords stored in his 1Password password manager. Using the stolen credentials, Cramer gave an access to Disney's Slack channels where he downloaded the data. The Department of Justice says that Kramer then contacted the employee posing as a Russian hacktivist group called Null Bulge, warning that the personal information of the employee and Disney stolen Slack data would be published if the employee didn't cooperate. When Kramer heard nothing back from the employee, he he released the data. There were at least two other people who downloaded Cramer's malware, and the FBI is following up with those victims. Just when you thought signalgate couldn't be worse, it did. Late last week, a photograph of now former National Security Advisor Mike Waltz showed he was using an open source Signal derivative app called TM Signal. Micaiah Lee, an information security engineer, software engineer, investigative data journalist and author, says in several blog posts that there are a number of security concerns with TM Signal. He points out that the company that provides it, telemessage, is headed by a former leader in the Israeli Defense Force's elite intelligence unit. Lee says the TM Signal app works by using Signal servers, making it possible for Waltz to send end to end encrypted messages to normal Signal users like Jeffrey Goldberg from the Atlantic, for example. However, unlike the Signal end to end encrypted conversation, TM Signal automatically archives a copy of the plain text messages, even ones with disappearing messages somewhere else that may or may not be secure. One optional destination a Gmail account. Lee was also able to get access to the source code for TM Signal. In his analysis, he found hard coded credentials a big security no no as well as other vulnerabilities, researchers have revealed a collection of bugs known as Airborne that would allow any hacker on the same WI Fi network as AirPlay enabled devices to covertly run their own code on those devices. Apple's AirPlay enables iPhones, iPads and Macs to seamlessly play music or show photos and videos on other Apple devices or third party speakers and TVs that integrate the protocol. The uncovered security flaws in AirPlay means those same wireless connections can allow hackers to move within a network just as easily, spreading malicious code from one infected device to another. Airborne, and for those of you like me who had hoped for or thought we had moved past the era of branded vulnerabilities, is particularly dangerous because many smart home devices, including third party TVs, are not regularly updated by owners or sometimes even by device makers. The bugs in Apple's AirPlay software development kit or SDK for third party devices would allow hijackers to hijack gadgets like speakers, receivers, set top boxes or smart TVs if they're on the same Wi Fi network as a hacker's machine. Apple told Wired that those bugs could only have been exploited when users change default airplay settings. Bottom line? Make sure you patch all your Apple devices and any third party devices that use AirPlay. And make sure you educate employees, particularly ones with privileged access, about smart home security through your cybersecurity awareness education efforts. Their resource services and employee benefits Administration Service Provider has determined that a previously announced data breach was far worse than initially thought and affects up to 4 million individuals. The Houston, Texas based company detected a hacking incident on February 28, 2024 that disrupted access to some of its systems. Third party cybersecurity and incident response experts were engaged to investigate the incident and determine the nature and scope of the unauthorized activity. The forensic investigation confirmed that hackers had access to Verisource's network and had exfiltrated files on February 27, 2024. At the time of the initial announcement, Verisource Services said names, dates of birth, genders and Social Security numbers had been stolen. The affected individuals included employees and dependents of clients who used its services, which included hr, outsourcing, benefits, enrollment, billing and administrative services. The data breach was initially reported as affecting 1,382 individuals, but as the investigation progressed it became clear the breach was far worse than initially thought and this is not uncommon In August of 2024, the data breach was reported to the HHS Office for Civil Rights as it involved the protected health information of 112,000 individuals. The most recent notification to the Maine Attorney General's office indicates now that 4 million individuals may have been affected, a sizable increase from previous estimates. The OCR Breach portal still lists the incidents as affecting 12000 patients and plan members of its HIPAA regulated entity clients, although the total may be updated in the coming days. Verisource Services explained in the breach notice that the data review was not completed until April 17, 2025, almost 14 months after the security incident was detected. We are always interested in your opinion and you can contact us at editorialech newsday ca or leave a comment under the YouTube video. I've been your host, David Shipley, sitting in for Jim Love, who will be back on Wednesday. Thanks for listening.