How the Signal Knockoff App TeleMessage Got Hacked in 20 Minutes

TeleMessage, an encrypted messaging app used by former Trump administration officials like Mike Waltz, was easily hacked due to critical security flaws, including weak password hashing and a misconfigured Spring Boot Actuator endpoint that exposed sensitive data like usernames, passwords, and unencrypted chat logs. A hacker accessed this data in approximately 20 minutes, compromising a U.S. Customs and Border Protection user and exposing Coinbase internal chats, raising concerns about data security practices within government and corporate use of the platform. The incident highlights the risks of using outdated or misconfigured software, particularly in sensitive communications.

Analysis

TeleMessage, a messaging platform recently acquired by Smarsh and notably used by former U.S. national security adviser Mike Waltz, experienced a significant security breach stemming from fundamental flaws in its architecture and security practices. The hack, executed in approximately 15 to 20 minutes, exploited vulnerabilities including client-side MD5 password hashing for its admin panel (secure.telemessage.com) and, crucially, a publicly exposed Java heap dump endpoint on its archive server (archive.telemessage.com). This misconfiguration, likely due to an outdated Spring Boot version or manual override of default security settings, allowed unauthorized access to sensitive data including usernames, passwords, unencrypted chat logs, and encryption keys. The breach impacted users such as U.S. Customs and Border Protection and exposed internal chats from Coinbase, although Coinbase stated no sensitive customer account data was compromised. This incident starkly contrasts with TeleMessage's marketing claims of end-to-end encryption, as messages were reportedly uploaded unencrypted to the archive server. The identified vulnerabilities, such as the exposed heap dump endpoint, are well-documented risks, indicating a severe lapse in TeleMessage's security posture prior to and potentially post-acquisition by Smarsh. The overall sentiment surrounding this event is negative, reflecting the critical nature of these security failures.

Key Decisions for Investors

• Investors should consider this breach a significant operational and reputational risk for Smarsh, warranting scrutiny of their due diligence processes related to the TeleMessage acquisition and potential liabilities.
• For Coinbase (COIN), while direct customer account compromise is denied, the exposure of internal communications via a third-party vendor highlights potential weaknesses in vendor risk management that could merit investor attention.
• This incident underscores the heightened importance of cybersecurity due diligence for companies reliant on third-party communication and data archiving services, particularly those handling sensitive information, potentially impacting investment attractiveness if not robustly managed.