4 ms·

Steve Witkoff was on the chat while he was in Russia. There’s a vulnerability in Signal where you can set up linked devices that replicate your signal messages

by simonh 2y ago

Steve Witkoff was on the chat while he was in Russia. There’s a vulnerability in Signal where you can set up linked devices that replicate your signal messages. You can do this by just scanning a QRcode. This is known to be used by Russian hackers. What are the chances the Russians duped Witkoff into scanning a QR code while he was in Moscow?

HumblyTossed 2y ago
> What are the chances the Russians duped Witkoff into scanning a QR code while he was in Moscow? What are the chances this admin had him do it ON PURPOSE?
- throwaway5752 2y ago
  And why would they when they can pop Starlink and get a far bigger prize? https://www.nytimes.com/2025/03/17/us/politics/elon-musk-starlink-white-house.html https://www.nytimes.com/2025/03/17/us/politics/elon-musk-sta...
bb88 2y ago
Why must a Signal attack take place only in Russia? If Russia intelligence operations can operate freely in the US, they can attack US Officials in the US as well.
- simonh 2y ago
  Good point. I was just thinking Witkoff must be dealing with Russian functionaries all the time in Moscow so they have near constant direct access. There’s nothing to stop them duping one of them in the US though, and it doesn’t seem like duping these guys would be a stretch.
  - bb88 2y ago
    Honestly, the Russians probably already have done so. It's just a matter of who's phone in that group has been compromised. In a previous world, some three letter agency (FBI maybe?) would seize the phones in the chat to investigate the leak.
- beefnugs 2y ago
  Man in the middle attacks require access to the mobile or networking infrastructure (so not necessary, but much more likely and easy)
belter 2y ago
What are the chances Trump portrait[1] has a passive microphone? [2] [1] "Putin gave Trump portrait to envoy, Kremlin confirms" - https://thehill.com/policy/international/5212691-putin-trump-portrait-witkoff-russia/ https://thehill.com/policy/international/5212691-putin-trump... [2] https://en.wikipedia.org/wiki/The_Thing_(listening_device) https://en.wikipedia.org/wiki/The_Thing_(listening_device)
uberdru 2y ago
Totally! Probably for a restaurant menu or something. . . It also seems likely that they added Jeffrey Goldberg, (the Atlantic's editor-in-chief) to the chat as the outlet, so the whole thing would become public. . . .
- bb88 2y ago
  How about a restaurant that doesn't have menus and requires patrons to scan a QR code? Acrylic table menus have inserts which can be easily replaced.
  - stavros 2y ago
    You guys are forgetting that you have to scan the QR code from Signal's "link new device" menu, and then approve the new device, which is a somewhat uncommon thing for a restaurant menu to ask you to do.
    - simonh 2y ago
      That’s one way, but. https://thehackernews.com/2025/02/hackers-exploit-signals-linked-devices.html https://thehackernews.com/2025/02/hackers-exploit-signals-li... “… the threat actors, including one it's tracking as UNC5792, have resorted to malicious QR codes that, when scanned, will link a victim's account to an actor-controlled Signal instance.” “ These QR codes are known to masquerade as group invites, security alerts, or legitimate device pairing instructions from the Signal website.” Also “ Last week, Microsoft and Volexity also revealed that multiple Russian threat actors are taking advantage of a technique called device code phishing to log into victims' accounts by targeting them via messaging apps like WhatsApp, Signal, and Microsoft Teams.”
      - Zak 2y ago
        That's just phishing. Signal could make the pairing attack impossible by eliminating the device pairing feature, but that would also reduce its appeal and harm its mission of bringing secure communication to a broad audience. It could add steps to setting up a group chat and inviting additional members to make it less likely users will invite the wrong person, but that, too would hurt its popularity. Security is a process and a spectrum, not a binary that can be guaranteed by using a certain product or service.
m000 2y ago
Right. So the problem is not that everyone in the chat was using an unsanctioned app to exchange classified information, but these insidious Ruskies who tricked Witkoff and hacked his personal Signal account.
- simonh 2y ago
  That's the White House line, apparently they did nothing wrong. It's that Journalists's fault. It can't be the Russians though, they're trusted allies now.
lucb1e 2y ago
> There’s a vulnerability in Signal where you can set up linked devices that replicate your signal messages. You mean the desktop linking feature? If that's considered a vulnerability, then so is being able to chat with someone after getting their public key unverified from an overseas server, the primary mode in which everyone uses it (including the people in this chat, evidently, since no out-of-band key exchange was performed)... Not to mention the "vulnerability" where you copy the phone's storage and get the key material onto another device to do with what you will, which may be harder or easier depending on the hardware but I'd trust any sufficiently funded security agency to be able to do this for common devices
- remus 2y ago
  If you're part of the US government, with access to the most sensitive information which will put people's lives at risk if compromised, then yes this is a vulnerability because "russian GRU agent nicks your phone and scans your signal QR code" is a real threat.
  - regularjack 2y ago
    If you're part of the US government, you're not supposed to use signal to discuss this kind of stuff.
  - lucb1e 2y ago
    Bringing in a phone with decryption keys for this conversation is a risk, then, not just Signal's featureset... I agree it could be hardening to allow users/organizations to disable this feature, and also other features such as automatic media decoding and other mechanisms that are trade-offs between security and usability, but simply does not meet the definition of a vulnerability (nobody will assign this a CVE number to track the bug and "resolve" it)

by simonh 2y ago

HumblyTossed 2y ago

> What are the chances the Russians duped Witkoff into scanning a QR code while he was in Moscow? What are the chances this admin had him do it ON PURPOSE?

throwaway5752 2y ago
And why would they when they can pop Starlink and get a far bigger prize? https://www.nytimes.com/2025/03/17/us/politics/elon-musk-starlink-white-house.html https://www.nytimes.com/2025/03/17/us/politics/elon-musk-sta...

bb88 2y ago

Why must a Signal attack take place only in Russia? If Russia intelligence operations can operate freely in the US, they can attack US Officials in the US as well.

simonh 2y ago
Good point. I was just thinking Witkoff must be dealing with Russian functionaries all the time in Moscow so they have near constant direct access. There’s nothing to stop them duping one of them in the US though, and it doesn’t seem like duping these guys would be a stretch.
- bb88 2y ago
  Honestly, the Russians probably already have done so. It's just a matter of who's phone in that group has been compromised. In a previous world, some three letter agency (FBI maybe?) would seize the phones in the chat to investigate the leak.
beefnugs 2y ago
Man in the middle attacks require access to the mobile or networking infrastructure (so not necessary, but much more likely and easy)

belter 2y ago

What are the chances Trump portrait[1] has a passive microphone? [2] [1] "Putin gave Trump portrait to envoy, Kremlin confirms" - https://thehill.com/policy/international/5212691-putin-trump-portrait-witkoff-russia/ https://thehill.com/policy/international/5212691-putin-trump... [2] https://en.wikipedia.org/wiki/The_Thing_(listening_device) https://en.wikipedia.org/wiki/The_Thing_(listening_device)

uberdru 2y ago

Totally! Probably for a restaurant menu or something. . . It also seems likely that they added Jeffrey Goldberg, (the Atlantic's editor-in-chief) to the chat as the outlet, so the whole thing would become public. . . .

bb88 2y ago
How about a restaurant that doesn't have menus and requires patrons to scan a QR code? Acrylic table menus have inserts which can be easily replaced.
- stavros 2y ago
  You guys are forgetting that you have to scan the QR code from Signal's "link new device" menu, and then approve the new device, which is a somewhat uncommon thing for a restaurant menu to ask you to do.
  - simonh 2y ago
    That’s one way, but. https://thehackernews.com/2025/02/hackers-exploit-signals-linked-devices.html https://thehackernews.com/2025/02/hackers-exploit-signals-li... “… the threat actors, including one it's tracking as UNC5792, have resorted to malicious QR codes that, when scanned, will link a victim's account to an actor-controlled Signal instance.” “ These QR codes are known to masquerade as group invites, security alerts, or legitimate device pairing instructions from the Signal website.” Also “ Last week, Microsoft and Volexity also revealed that multiple Russian threat actors are taking advantage of a technique called device code phishing to log into victims' accounts by targeting them via messaging apps like WhatsApp, Signal, and Microsoft Teams.”
    - Zak 2y ago
      That's just phishing. Signal could make the pairing attack impossible by eliminating the device pairing feature, but that would also reduce its appeal and harm its mission of bringing secure communication to a broad audience. It could add steps to setting up a group chat and inviting additional members to make it less likely users will invite the wrong person, but that, too would hurt its popularity. Security is a process and a spectrum, not a binary that can be guaranteed by using a certain product or service.

m000 2y ago

Right. So the problem is not that everyone in the chat was using an unsanctioned app to exchange classified information, but these insidious Ruskies who tricked Witkoff and hacked his personal Signal account.

simonh 2y ago
That's the White House line, apparently they did nothing wrong. It's that Journalists's fault. It can't be the Russians though, they're trusted allies now.

lucb1e 2y ago

> There’s a vulnerability in Signal where you can set up linked devices that replicate your signal messages. You mean the desktop linking feature? If that's considered a vulnerability, then so is being able to chat with someone after getting their public key unverified from an overseas server, the primary mode in which everyone uses it (including the people in this chat, evidently, since no out-of-band key exchange was performed)... Not to mention the "vulnerability" where you copy the phone's storage and get the key material onto another device to do with what you will, which may be harder or easier depending on the hardware but I'd trust any sufficiently funded security agency to be able to do this for common devices

remus 2y ago
If you're part of the US government, with access to the most sensitive information which will put people's lives at risk if compromised, then yes this is a vulnerability because "russian GRU agent nicks your phone and scans your signal QR code" is a real threat.
- regularjack 2y ago
  If you're part of the US government, you're not supposed to use signal to discuss this kind of stuff.
- lucb1e 2y ago
  Bringing in a phone with decryption keys for this conversation is a risk, then, not just Signal's featureset... I agree it could be hardening to allow users/organizations to disable this feature, and also other features such as automatic media decoding and other mechanisms that are trade-offs between security and usability, but simply does not meet the definition of a vulnerability (nobody will assign this a CVE number to track the bug and "resolve" it)