97 ms·
The page is also quite vague about how the attacker got these 1900 phone numbers. It seems to imply that they were just the ones around when the attacker got ac
by joosters 4y ago
The page is also quite vague about how the attacker got these 1900 phone numbers. It seems to imply that they were just the ones around when the attacker got access. But it doesn’t actually state that clearly. Were they 1900 random numbers or were they chosen somehow? The latter is of course far worse.
They also apparently have logs of the attacker searching out three specific accounts within these 1900. That seems odd. What’s the chance that, out of all signal accounts, the three they are curious about just happen to be among the 1900 they got access to? (Perhaps signal/trillio don’t have logs from failed searches? That would be pretty poor logging though)
- Confiks 4y agoThe attacker sought out 3 specific numbers. The 1900 number is the amount of registrations that occurred during the time the attacker had access to re-register their Signal account – but likely mostly didn't.
- pr0zac 4y agoThose 1900 phone numbers would be all the accounts that started the registration/re-registration process with Signal during the time the unauthorized access was available. That process is started on Signal's side and Twilio is only used at the midway point to send a device verification SMS. Any Signal accounts that did not start that process during that time would not be able to be intercepted or accessed since Twilio has no means to begin it. The three specific accounts mentioned would be the cases found that the verification message was accessed through Twilio to register the account on the attacker's device. So yes, in effect the 1900 were only the ones around when the attacker got access. Whether the specific three were targeted attacks or random messing around isn't clear though.