The communication application TM Signal, created by TeleMessage, has drawn scrutiny due to serious security vulnerabilities. Following a hack that exposed user messages, an analysis by journalist and security researcher Micah Lee revealed that the app transmits user message logs in plaintext. This undermines the security assurances typically associated with end-to-end encrypted messaging apps, casting doubt on the claims made by TeleMessage regarding its security capabilities.
Lee’s investigation unearthed that TM Signal, which was reportedly utilized by high-ranking officials from the Trump administration, does not employ effective end-to-end encryption. Instead, it sends messages in an unencrypted format, allowing TeleMessage direct access to users’ communications. This was evident from the data compromised during a recent security breach, which included chat logs, usernames, plaintext passwords, and private encryption keys.
In response to these findings, TeleMessage stated that they are investigating a potential security incident and have paused services while engaging external cybersecurity assistance. However, prior reports indicated that TM Signal had previously been hacked and that users’ data was at risk of exposure, raising critical national security concerns.
The significance of these security flaws is intensified by TM Signal’s use by key figures such as former national security adviser Mike Waltz, who was seen using the app during a cabinet meeting. This tool, which appears to mimic the legitimate Signal app, presents a serious risk, particularly when senior officials utilize it for sensitive communications.
U.S. Senator Ron Wyden has called for a Department of Justice inquiry into TeleMessage, describing it as a severe national security threat. He criticized the government agencies selecting TeleMessage for communications, noting that they have opted for a subpar alternative that jeopardizes the security of their communications.
For more information, you can check out the following links:
