BleepingComputer says the fact that you have messaged them, even with a one-character reply, means the iPhone considers them legitimate and unblocks their links. Using electromagnetic fault injection at this critical juncture, they successfully bypassed the validation checks and booted a modified firmware patch into the chip’s CPU. Security researcher Thomas Roth discovered a vulnerability in the USB-C controller chip first introduced into Apple’s supply chain in 2023.
Public Warning System Security: How Cell Broadcast Alerts Are Spoofed And What Operators Control
They strike at the heart of trust, trust between colleagues, between brands and customers, and between organizations and the public. It erodes confidence in the systems we use to communicate, collaborate, and make decisions. If your app’s React code does not use a server, your app is not affected by this vulnerability. If your app does not use a framework, bundler, or bundler plugin that supports React Server Components, your app is not affected by this vulnerability. Chainalysis’ latest crime report notes that over $2.17 billion has been stolen so far in 2025, a pace that would take crypto-related thefts to new highs.
Weak Origin Validation In Postmessage Listeners
Attacks attributed to groups like Salt Typhoon against major telecommunications providers have highlighted the fragility of the communications infrastructure that underpins governments, businesses, and critical services. Faced with this sense of vulnerability, many organizations have turned, almost instinctively, to consumer messaging apps as a quick fix to “secure” internal communications. Finally, it’s important not to forget the role of messaging apps as a distribution channel for malicious files . For communications, marketing, and PR professionals, these technical flaws translate into operational risks. Confidential media strategies, embargoed press releases, and crisis response plans often flow through encrypted messaging apps.
With these apps, “your communications are end-to-end encrypted every single time,” she says. The problem is that these tools, while offering better protection than SMS or unencrypted email , are not designed for the level of security required for high-value strategic communications. They tend to concentrate the infrastructure in a few of the provider’s data centers, creating single points of failure and prime targets for attackers and legal pressure from foreign governments. Throughout this article, we will calmly but frankly examine why these tools are not harmless, what real risks they pose, and what alternatives and best practices exist to minimize the potential for disaster.
But are these communication tools secure, reliable, compliant and able to safeguard our data? Recent incidents involving major players like Disney, Zoom, Microsoft Teams, WhatsApp, and Discord highlight the vulnerabilities inherent in these communication tools. From massive leaks of internal documents to the exposure of sensitive user information, these breaches serve as a stark reminder that these platforms are not secure. These platforms handle critical activities including social interactions, financial transactions, and business communications for billions of users globally, making successful attacks particularly devastating. That code, which many apps (including banking, social media, and SMS-ID authentication systems) use as a second layer of security , is the master key. Sharing it, even “because a friend asked for it,” is tantamount to handing over control of the account on a silver platter.
- The app includes debugging functionality triggered when users access URLs containing specific parameters, which attackers can abuse to execute high-risk actions like configuration changes without user awareness.
- When users update their contact profiles, including nickname, photo, or wallpaper, the system generates “Nickname Updates” that are processed by recipients’ devices.
- With the rise of remote work,these platforms keep teams connected and productive, regardless of physical distance.
- There’s almost no precedent for the heads of defense, state, intelligence and national security to be sharing such sensitive military intelligence in a forum that was known to be unsecured.
The platform employs strict validation for sensitive operations, restricting debugging functions and enforcing HTTPS-only protocols with domain validation for configuration changes. In the realm of data sovereignty, the use of global services also means that information can end up stored in jurisdictions with very different access laws , or even laws that contradict local regulations. This opens the door both to intelligence gathering by third-party states and to complex legal battles over which legislation applies to each piece of information. A prime example was the Signal chat among high-ranking officials in the Trump administration , in which military operations against the Houthis in Yemen were coordinated. As security expert Luis Corrons pointed out, a careful attacker would perform the scan slowly and across many IP addresses , blending in with normal traffic and evading detection.
Notable security attacks over the past months include physical “wrench attacks” on Bitcoin holders and high-profile incidents such as the February hack of crypto exchange Bybit. TeleMessage is similar to the Signal App but allows for the archiving of chats for compliance purposes. Based in Israel, the company was acquired by US company Smarsh in 2024, before temporarily suspending services after a security breach in May that resulted in files being stolen from the app. As with any security tool, knowing its capabilities is just as important as knowing its weaknesses.
This browser API was initially introduced to enable controlled cross-origin data exchange, as it provides a way for iframes, pop-ups, and opened windows to send messages to each other without violating the browser’s same-origin policy. She recommends getting 2FA messages through an app like Google Authenticator or Authy or by using a physical security key to verify access. “Encryption is your friend” for texts and phone calls, Jeff Greene, CISA’s executive assistant director for cybersecurity, said on the briefing call. “Even if the adversary is able to intercept the data, if it is encrypted, it will make it impossible, if not really hard, for them to detect it. So our advice is to try to avoid using plain text.”
On an individual level, there are several guidelines anyone can follow to reduce their exposure when using messaging apps. The first is to treat phone numbers and codes received via SMS as sensitive credentials that should never be shared , even if the person requesting them appears to be a friend, a technician, or the app itself. Cellcrypt adopts a zero-knowledge architecture with end-to-end encryption and client-side key control . This is complemented by double-layer post-quantum encryption, based on NIST-standardized algorithms, designed to withstand both current attacks and future “capture now, decrypt later” scenarios when quantum computing becomes a realistic threat. From smishing (SMS phishing) to interception of authentication codes, location tracking, and SMS flooding attacks, the humble text message has become a prime vector for telecom fraud and surveillance. Even in 2025, SMS-based attacks remain one of the easiest ways for adversaries to exploit signaling vulnerabilities in SS7, SIGTRAN, Diameter, and LTE networks.
Reporting Postmessage Vulnerabilities
And as recent incidents have shown, even the best tools can be compromised if used carelessly. Communications leaders must stop thinking of security as someone else’s job and start treating it as a core part of their own. Although security weaknesses in apps are more common than desired, the TeleMessage vulnerability could be significant for its users, such as government organizations and enterprises. Users of the app may include former US government officials like Mike Waltz, US Customs and Border Protection and crypto exchange Coinbase.
Misconfigurations that stem from weak regex pattern matching often arise due to a lack of proper testing. Burp Suite DOM Invader is a browser extension built into Burp Suite’s embedded browser that automatically detects DOM-based vulnerabilities, including postMessage bugs. DOM Invader monitors postMessage traffic, identifies message handlers, and can automatically test for XSS by injecting canary values into messages. It highlights potentially dangerous sinks and provides a visual representation of message flows. Modern applications often minify and obfuscate their JavaScript as part of optimizing site traffic, making manual review challenging. To counter this, use your browser’s developer tools to format the code, or leverage third-party services that aim to make the code more readable.
As communication tools become integral to business operations, data breaches involving communication tools can have far-reaching consequences for organizations and individuals. For instance, when email accounts are compromised, sensitive information can be leaked, leading to significant financial losses and reputation damage. Similarly, vulnerabilities in messaging apps can allow unauthorized access to confidential conversations, risking the exposure of trade secrets. In the realm of video conferencing, lapses in security can permit uninvited guests to join meetings, potentially disrupting discussions and leaking sensitive content. High-security messaging apps like Signal can be compromised, either www.thelauradate.com/ by human error or cyberattacks.
By carefully measuring electromagnetic signals during the chip’s startup process, they identified the precise moment when firmware validation occurred. WeChat’s Android client uses the XWEB engine, a Chromium-based browser lagging behind official releases (v130 vs. Chrome’s v136). Despite this, XWEB employs sandboxing, isolating rendering processes (xweb_sandboxed_process_0) from privileged ones to mitigate exploits. JSBridge interfaces, which enable web-to-native functions like scanQRCode, are tightly controlled via cloud-based permission arrays, limiting access for untrusted sites.
They raise urgent questions about how secure our “secure” tools really are, and what’s at stake when those tools fall short. And when even the most trusted platforms show cracks, the consequences stretch far beyond the IT department. PostMessage vulnerabilities can represent a significant attack surface in modern web applications, yet they often go undetected due to their client-side nature and the manual analysis required to identify them.
The less information that’s publicly available, the harder it will be for an attacker to create a convincing scam or link your number to other leaked data. In recent months, there has also been an increase in attempts to hijack WhatsApp accounts using social engineering. Leveraging personal data collected from previous breaches or social media, the attacker impersonates an acquaintance, technical support, or a trusted entity, convincing the victim to provide the verification code received via SMS. A typical example is an email that appears to be from WhatsApp and invites you to “back up your messages and call history” via a link. Clicking on it, instead of a backup, downloads malicious software that can steal data, take control of the account, or even persistently infect the device. When a user links their WhatsApp client on a new device, synchronization messages propagate chat histories and media over multiple endpoints.
Most notably, researchers observed these crashes on at least one device belonging to a senior European Union government official approximately thirty days before they received an Apple Threat Notification. Researchers say the surge in SMS spam coincides with new features added to a popular commercial phishing kit sold in China that makes it simple to set up convincing lures spoofing toll road operators in multiple U.S. states. It’s the equivalent of someone demanding access to my iPhone with a gun to my head, which is more likely a thing to happen than someone getting hold of my iPhone, and attempting to do this electromagnetic whatsit. If they can convince you to reply to the message, even with a STOP command intended to instruct a legitimate sender not to message you again, then this protection is disabled. More recently, security firm Trend Micro uncovered the “Earth Minotaur” threat group using the Moonshine exploit kit to deploy spyware through WeChat, primarily targeting ethnic minority communities.