'Heapdump' is a term I learned from debugging android applications 15 years ago. Its just a snapshot of the java processes memory. Its going to contain plaintext. Now why those heaps are available at an open http endpoint is another matter, and is the interesting point. I'm guessing the client code had that endpoint hardcoded somewhere or they saw a request to it. I'm not seeing how they could know anything about the back end or how the messages are stored from this. Did I miss something?
DDoSecrets publishes 410 GB of heap dumps, hacked from TeleMessage
161–170 of 209 posts
Re: DDoSecrets publishes 410 GB of heap dumps, hacked from TeleMessage
#162Earlier quoted context omitted.
Amazingly the app is on the governments list of approved apps. The scandal is what they’re discussing on there: highly sensitive information you normally go to very secure channels to talk about.
My understanding is that it was added fairly recently at that, and already this has happened. This must be a record time in "change of policy leading to the most embarassing result". Only a couple of months!
According to the article: "TeleMessage has been used by the federal government since at least February 2023"
I don't know if that use was authorized or not.
Re: DDoSecrets publishes 410 GB of heap dumps, hacked from TeleMessage
#163Earlier quoted context omitted.
There’s room for both sides of the razor. The heapdumpz could be there maliciously, but incompetently made globally accessible.
From the Wired article: "The archive server is programmed in Java and is built using Spring Boot, an open source framework for creating Java applications. Spring Boot includes a set of features called Actuator that helps developers monitor and debug their applications. One of these features is the heap dump endpoint," So the heapdumps being available is a Spring Boot feature so it does not appear to be malicious.
I'm the original author of the Spring Boot feature for heapdumps: https://github.com/spring-projects/spring-boot/pull/5670.
It seems that users commonly misconfigure Spring Boot security or ignore it completely. To improve the situation, I made this PR: https://github.com/spring-projects/spring-boot/pull/45624.
When the PR was created in 2016, endpoints were marked as "sensitive" and, for example, the heapdump endpoint would have to be explicitly enabled. However, Spring Boot has evolved over the years, and only the "shutdown" endpoint was made "restricted" in the later solutions. My recent PR will address that weakness in Spring Boot when users misconfigure or ignore security for a Spring Boot app so that heapdumps won't get exposed by default.
Re: DDoSecrets publishes 410 GB of heap dumps, hacked from TeleMessage
#164Earlier quoted context omitted.
This is why Signal is so opposed to third-party apps (or forks) that connect to their service. If you want to keep the branding of Signal being the secure app, you need to make sure that all Signal users are actually using a secure version of Signal. If an insecure fork (like this one) becomes too popular, most groups will have at least one member using it, and then the security is gone.
That doesn't seem to be a problem for protocols and having a single implementation can lead to bugs that defy spec yet cause no issues obviously.
[deleted]
Re: DDoSecrets publishes 410 GB of heap dumps, hacked from TeleMessage
#165Earlier quoted context omitted.
> The citizens of affected nations need to be made angry by their leaders' failure to do their jobs correctly, and that's only gonna happen when there are consequences for their actions. This is a really dangerous line of thinking. It's the line of thought that slides forwards to "I love America so much, but to save America I have to get Americans to really feel the pain, and to do that I need to to them to wake them…
If we really think about the issue, then it is clear that 99.99% of the government information can be public with zero consequences to the citizens. I'm guessing the only few exceptions are active military ops, active spy ops and ways to access secure systems (passwords etc.). Everything else is more or less safe. Embarrassing to the politicians, but safe.
You need to account for the risk of blackmail, persecution, and embarrassment (e.g., evidence of infidelity, refugee status, medical condition). Most of the time, citizens have the right to keep secrets or lie.
Re: DDoSecrets publishes 410 GB of heap dumps, hacked from TeleMessage
#166It's been weeks since the initial TeleMessage revelation... has the Signal Foundation responded in any way to the news? They condemn open source third-party clients and threaten trademark litigation when people use the "Signal" name in interop projects. Meanwhile, total silence when a defense contractor does the same thing.
Protecting your name is perfectly fine. You're allowed to make a fork of Firefox, you just can't call it Firefox or use any of Mozilla's branding. You're allowed to fork the open source part of VS Code, you just can't call it that or use Microsoft's branding. etc. etc. - you're free to do with open source whatever the license allows, but you're not allowed to use the original name or branding because you have zero rights to those unless the license explicitly stipulates how the name may be used by forks (like how tons of folks use the "Linux" name, and all of them do so with explicit written permission from the Linux foundation, as they own that name as a trademark)
Re: DDoSecrets publishes 410 GB of heap dumps, hacked from TeleMessage
#167Does TM's SGNL still work on Signal's servers? Has Signal said that they do allow Telemessage's custom signal client use on their servers?
Re: DDoSecrets publishes 410 GB of heap dumps, hacked from TeleMessage
#168It's been weeks since the initial TeleMessage revelation... has the Signal Foundation responded in any way to the news? They condemn open source third-party clients and threaten trademark litigation when people use the "Signal" name in interop projects. Meanwhile, total silence when a defense contractor does the same thing.
I'm annoyed by moxie vs fdroid as the next guy, but this is way above his desire to make a buck from his honest work. this is about an overseas elite who profited from US war aid for decades holding the US presidency by the balls, and everyone think this is just incopetence. think for a second, if any other administration was using a telephone or a communication software made by a never heard before company overseas,…
> if any other administration was using a telephone or a communication software made by a never heard before company overseas, would you think it was just incompetence?
One interesting thing I saw in the original article was that the US was using TeleMessage since February 2023. If that's true, it means we have two administrations who are responsible for this choice.
Re: DDoSecrets publishes 410 GB of heap dumps, hacked from TeleMessage
#169Earlier quoted context omitted.
Aren’t those Israeli software companies all supposed to be top notch, ex Mossad, yadda yadda? Doesn’t sound like it. I hope the message dump is juicy.
I'm not sure why you'd expect intelligence agency types to be particularly good at engineering, tbh.
I'm not sure about this case, but maybe the assumption here is that these are people from a technical branch of Mossad, such as Unit 8200, which does SIGINT. I've interviewed 3 of them for your typical Big Tech SWE position, and to a candidate, they were very strong engineers. I never got to work with them, however, because they always got better counteroffers...
Re: DDoSecrets publishes 410 GB of heap dumps, hacked from TeleMessage
#170Earlier quoted context omitted.
Can you imagine co-opting a trusted and secure (and free) bit of software and just making it worse at seemingly every turn? And charging for it?! I’m not sure what is more embarrassing: to be the company or to be a user.
This is why Signal is so opposed to third-party apps (or forks) that connect to their service. If you want to keep the branding of Signal being the secure app, you need to make sure that all Signal users are actually using a secure version of Signal. If an insecure fork (like this one) becomes too popular, most groups will have at least one member using it, and then the security is gone.
That was Apple's same reasoning for shutting down that iMessage client app. These leaks seem to justify their concerns.