DDoSecrets publishes 410 GB of heap dumps, hacked from TeleMessage

Post by terom » Wed, May 21, 2025, 12:22 PM UTC

evrflx wrote: post #67

pigbearpig wrote: post #42

Earlier quoted context omitted.

From the Wired article: "The archive server is programmed in Java and is built using Spring Boot, an open source framework for creating Java applications. Spring Boot includes a set of features called Actuator that helps developers monitor and debug their applications. One of these features is the heap dump endpoint," So the heapdumps being available is a Spring Boot feature so it does not appear to be malicious.

This feature must be explicitly enabled, it is not on by default nor by accident.

Post by aesh2Xa1 » Wed, May 21, 2025, 2:16 PM UTC

pchristensen wrote: post #170

miki123211 wrote: post #125

Earlier quoted context omitted.

This is why Signal is so opposed to third-party apps (or forks) that connect to their service. If you want to keep the branding of Signal being the secure app, you need to make sure that all Signal users are actually using a secure version of Signal. If an insecure fork (like this one) becomes too popular, most groups will have at least one member using it, and then the security is gone.

That was Apple's same reasoning for shutting down that iMessage client app. These leaks seem to justify their concerns.

Post by Anamon » Thu, May 22, 2025, 8:06 PM UTC

greyface- wrote: post #47

It's been weeks since the initial TeleMessage revelation... has the Signal Foundation responded in any way to the news? They condemn open source third-party clients and threaten trademark litigation when people use the "Signal" name in interop projects. Meanwhile, total silence when a defense contractor does the same thing.

Post by aorloff » Tue, May 27, 2025, 5:16 AM UTC

harrall wrote: post #182

BearOso wrote: post #156

Earlier quoted context omitted.

> They’re also not saying how much actual message content they have because the 410GB of heap dumps makes for a bigger headline number. That's very important to say. I went through one of these massive data dumps recently and it was literally all cached operating system package updates and routine logs. Nothing at all of interest. It's easy to cut the size on a heap dump. When it's not done it seems sketchy. But it c…

Most of the the heap dump will be filled with stuff like java.util.String!blahjava.util.ArrayList! Though the heap dump would have messages in flight at the time. It's obviously not as useful if you are just trying to grab messages for a specific person. Frankly the most useful part might be any in-memory secret keys, which could be useful for breaking deeper into the system.

Post by aorloff » Thu, May 29, 2025, 3:45 AM UTC

kleton wrote: post #160

Aurornis wrote: post #2

So one of their servers had a /heapdump endpoint that publicly served a heap dump of the server? This whole saga is out of control. This group didn’t really “publish” anything, though. They’re offering access to journalists through a request form. They’re also not saying how much actual message content they have because the 410GB of heap dumps makes for a bigger headline number.

TeleMessage is most likely an intelligence asset, and a burned one now that Trump's people stopped using it. A fake hack is the safest way for the agency responsible to leak the messages collected.