Russian Hackers Stealing Backup Data from Ukrainian Signal Accounts

Russian hackers are stealing backup data from individual accounts of Signal and users containing stored messages and media files, American agencies warned about this in a publication on Friday.

The Russians have collected sensitive information about individuals in Ukraine and Western Europe which includes military officials, politicians and journalists, the warning said.

The hackers have evolved their modus operandi to steal a large amount of data. Whereas the earlier method primarily focused on extracting verification codes for account access, the new method aims to steal ' Signal Backup Recovery keys ' via phishing. With this, the attackers attempt to gain access to stored backups.

The attackers use phishing messages sent to targets on behalf of ' Signal Support '. These create a false sense of urgency to entice the user to hand over the ' Signal Backup Recovery Key .'

As soon as the attackers have obtained the Recovery key , they can download the entire message history, including photos and documents from the past 45 days. Moreover, this Recovery key enables the attackers to take full control of the account.

If a victim has inadvertently handed over their Backup Recovery key, the only way to resolve this is to create a new Backup Recovery key . This renders the previous key unusable for future backup downloads. This does not prevent the perpetrator from having already downloaded a previous backup of the victim's account.

Why target Signal?

Intelligence services believe that the significant Russian attention to Signal can be explained by the application's good reputation. Signal is known as a reliable and independent means of communication with the option to send end-to-end encrypted messages. Therefore, the app is also frequently used within governments and among journalists.