Messaging app used by Trump’s adviser reportedly hacked

TeleMessage, a Signal-like app used by former US National Security Adviser Mike Waltz, has reportedly been hacked.

The hacker exploited a vulnerability in the app’s backend, allowing them to intercept some users’ messages.

The breach raised concerns about the security of communications involving high-ranking US officials, though messages from Waltz and other Trump administration officials were not intercepted.

Waltz’s use of the app became public after his removal from office, which followed controversy over his creation of a Signal group for real-time updates on US military actions in Yemen.

TeleMessage, owned by Smarsh, stores decrypted messages to ensure compliance with retention rules, but experts warn this can create security risks if not properly handled.

🔗 Source: Reuters

🧠 Food for thought

1️⃣ Unofficial messaging apps have a consistent history of security breaches in government contexts

The TeleMessage hack highlights recurring security vulnerabilities in messaging apps used by government officials.

In 2017, Confide, another app marketed as secure and used by Trump administration officials, was found to have critical vulnerabilities that could allow attackers to impersonate users, hijack sessions, and even alter message contents in transit 1.

Security experts described Confide’s vulnerabilities as significant security failures, despite its claims of “military-grade” encryption 1.

This latest TeleMessage breach shows how third-party messaging apps often fail to provide the level of security required for sensitive government communications, regardless of their marketing claims.

Federal agencies like NASA and the Interior Department have explicit policies prohibiting the use of unapproved messaging apps because of these recurring security risks 2.

2️⃣ Surveillance technologies specifically target “secure” messaging platforms

The TeleMessage breach reflects a broader trend where advanced surveillance technologies target supposedly secure messaging services.

In 2019, attackers exploited a WhatsApp vulnerability to install the NSO Group’s Pegasus spyware without requiring any user interaction—simply calling the target’s device was sufficient 3.