6 ms·

>Among the 1,900 phone numbers, the attacker explicitly searched for three numbers, and we’ve received a report from one of those three users that their account

>Among the 1,900 phone numbers, the attacker explicitly searched for three numbers, and we’ve received a report from one of those three users that their account was re-registered. I wonder if this was a curious attacker trying to see what they could do with their access, or a targeted attack.

AtNightWeCode 4y ago
I think someone might know that certain numbers belong to certain users and that they want to prove it. Happened a lot with Disqus accounts. You can btw use the password reset function on many sites to correlate it with notifications. Easy at public events.
deleted 4y ago
[deleted]
eadmund 4y ago
It sure feels like it was targeted. Is trying to re-register a Signal account the sort of thing an attacker is likely to do at random?
- JustSomeNobody 4y ago
  > Is trying to re-register a Signal account the sort of thing an attacker is likely to do at random? Yes. I mean why not, you've got the number(s).
- nisegami 4y ago
  Similar to the other reply, I imagine it would be along the lines of: "Holy shit are those Signal 2FA codes? That's wild" In my head, this is something a more teenager (e.g. Lapsus) might think?
joosters 4y ago
The page is also quite vague about how the attacker got these 1900 phone numbers. It seems to imply that they were just the ones around when the attacker got access. But it doesn’t actually state that clearly. Were they 1900 random numbers or were they chosen somehow? The latter is of course far worse. They also apparently have logs of the attacker searching out three specific accounts within these 1900. That seems odd. What’s the chance that, out of all signal accounts, the three they are curious about just happen to be among the 1900 they got access to? (Perhaps signal/trillio don’t have logs from failed searches? That would be pretty poor logging though)
- Confiks 4y ago
  The attacker sought out 3 specific numbers. The 1900 number is the amount of registrations that occurred during the time the attacker had access to re-register their Signal account – but likely mostly didn't.
- pr0zac 4y ago
  Those 1900 phone numbers would be all the accounts that started the registration/re-registration process with Signal during the time the unauthorized access was available. That process is started on Signal's side and Twilio is only used at the midway point to send a device verification SMS. Any Signal accounts that did not start that process during that time would not be able to be intercepted or accessed since Twilio has no means to begin it. The three specific accounts mentioned would be the cases found that the verification message was accessed through Twilio to register the account on the attacker's device. So yes, in effect the 1900 were only the ones around when the attacker got access. Whether the specific three were targeted attacks or random messing around isn't clear though.

AtNightWeCode 4y ago

I think someone might know that certain numbers belong to certain users and that they want to prove it. Happened a lot with Disqus accounts. You can btw use the password reset function on many sites to correlate it with notifications. Easy at public events.

deleted 4y ago

[deleted]

eadmund 4y ago

It sure feels like it was targeted. Is trying to re-register a Signal account the sort of thing an attacker is likely to do at random?

JustSomeNobody 4y ago
> Is trying to re-register a Signal account the sort of thing an attacker is likely to do at random? Yes. I mean why not, you've got the number(s).
nisegami 4y ago
Similar to the other reply, I imagine it would be along the lines of: "Holy shit are those Signal 2FA codes? That's wild" In my head, this is something a more teenager (e.g. Lapsus) might think?

joosters 4y ago

The page is also quite vague about how the attacker got these 1900 phone numbers. It seems to imply that they were just the ones around when the attacker got access. But it doesn’t actually state that clearly. Were they 1900 random numbers or were they chosen somehow? The latter is of course far worse. They also apparently have logs of the attacker searching out three specific accounts within these 1900. That seems odd. What’s the chance that, out of all signal accounts, the three they are curious about just happen to be among the 1900 they got access to? (Perhaps signal/trillio don’t have logs from failed searches? That would be pretty poor logging though)

Confiks 4y ago
The attacker sought out 3 specific numbers. The 1900 number is the amount of registrations that occurred during the time the attacker had access to re-register their Signal account – but likely mostly didn't.
pr0zac 4y ago
Those 1900 phone numbers would be all the accounts that started the registration/re-registration process with Signal during the time the unauthorized access was available. That process is started on Signal's side and Twilio is only used at the midway point to send a device verification SMS. Any Signal accounts that did not start that process during that time would not be able to be intercepted or accessed since Twilio has no means to begin it. The three specific accounts mentioned would be the cases found that the verification message was accessed through Twilio to register the account on the attacker's device. So yes, in effect the 1900 were only the ones around when the attacker got access. Whether the specific three were targeted attacks or random messing around isn't clear though.