From rick at linuxmafia.com Sun May 4 19:34:38 2025 From: rick at linuxmafia.com (Rick Moen) Date: Sun, 4 May 2025 19:34:38 -0700 Subject: [conspire] Signalgate gets dramatically worse Message-ID: <20250505023438.GB21438@linuxmafia.com> Thanks to two sharp-eyed analysts, there are plot twists in the SIgnalgate story. First, 404 Media journalist Joseph Cox noticed a Reuters photo of Mike Waltz checking his Signal messages during a Cabinet meeting and, surprise! It's not actually Signal Messenger, but rather a weird variant smartphone app from obscure Israeli company TeleMessage called TM SGNL -- coded by them to interoperate using the Signal Protocol., but wrapping that core protocol suite with some alarming additions. The firm, bought three years ago by Smarsh, Inc. (https://www.smarsh.com/press-release/smarsh-to-acquire-telemessage), also produces similarly mutated client code for Telegram, WhatsApp, and WeChat. The TM SGNL binary and source code were then analysed by cryptographer Micah Lee and others (https://micahflee.com/heres-the-source-code-for-the-unofficial-signal-app-used-by-trump-officials/). Most significantly, that extra layer of TeleMessage-produced code transparently sends an utterly plaintext copy of any Signal messages the app handles, across the Internet to a TeleMessage-operated server on one of Amazon's EC2 cloud-computing farm in Northern Virginia, for central archiving -- including content flagged for automatic, timed disappearance. This alone eviscerates Signal security. Even worse, the archiving code uses hardcoded credentials, an absolute no-no for secure communication (https://cwe.mitre.org/data/definitions/798.html), and is said to commit other blunders. (Lee has been doing further analysis over the weekend.) Within hours, a third-party coder (who has remained anonymous) used these elementary mistakes, particularly the hardcoded credentials, to break into TeleMessage's archiving data: https://micahflee.com/the-signal-clone-the-trump-admin-uses-was-hacked/ This included a significant sample (https://micahflee.com/the-signal-clone-the-trump-admin-uses-was-hacked/) of data related to Customs and Border Protection (CBP), the cryptocurrency giant Coinbase, and other financial institutions, and involving many other Federal officials. Other TM SGNL-using institutions shown in the gathered data include Scotiabank, Galaxy Digital, and Washington D.C. Metropolitan Police. The coder stressed that his break-in was easy, taking "about 15-20 minutes". And, as he pointed out, if it was easy for him, it'll have been also easy for countless others. Provisioning of TM SGNL is interesting: On Android, it's available only from a private App Store collection available to employees of a qualifying firm using Google Enterprise to manage devices. On iOS, there's a similar arrangement using the Apple Business Manager to distribute code to employees' devices. Both systems outsource administration of the employee's device to admins of the respective Mobile Device Management (MDM) service. Doubtless, the pointy-hairs in TrumpCo 2.0 who selected this setup thought it achieved greater security. Ironically, it creates and enforces dramatically less security. But, hey, maybe it's all worth it for them to evade the Federal Records Act. From slitt at troubleshooters.com Tue May 6 11:47:56 2025 From: slitt at troubleshooters.com (Steve Litt) Date: Tue, 6 May 2025 14:47:56 -0400 Subject: [conspire] Introduction to Tcl/Tk GUI applications: 5/7/2025 7pm Eastern Standard time Message-ID: <20250506144756.715412ef@mydesk.domain.cxm> Hi all, Where: GoLUG: https://meet.jit.si/golug When: Wednesday, 5/7/2025 7pm sharp Eastern Daylight time Arrive 15 minutes early for Microphone check & discussion Who: Steve Litt, Troubleshooter, Developer, Tech Writer What: Introduction to Tcl/Tk GUI applications Last month David Billsbrough introduced us to the Tcl computer language. This month Steve Litt takes it a step farther, introducing Tk, the GUI (Graphical User Interface) tool. Tk was written primarily in Tcl, and even though it's now available for most modern computer languages, it's easiest in its native Tcl. Starting with a Hello World Tk application, we'll then go on to explore widgets such as labels, buttons and inputs, discussing geometry managers and detailing the grid geometry manager. Changing widget properties at runtime is demonstrated. Time permitting, we'll explore a practical green/yellow/red/black speech timer. SteveT Steve Litt GoLUG Publicity Coordinator -------------- next part -------------- A non-text attachment was scrubbed... Name: junk.png Type: image/png Size: 6136 bytes Desc: not available URL: