'We are currently clean on OPSEC' - The Signalgate Saga

'We are currently clean on OPSEC' - The Signalgate Saga

Speakers: Micah Lee

Conference: DEF CON 33

YouTube: https://www.youtube.com/watch?v=5VlhsT5Kbsk

Slides: https://media.defcon.org/DEF%20CON%2033/DEF%20CON%2033%20presentations/Micah%20Lee%20-%20We%20Are%20Currently%20Clean%20on%20OPSEC%20The%20Signalgate%20Saga.pdf

Overview

In March 2025, the world witnessed what security researcher Micah Lee described as "unbelievable incompetence from the highest levels of the Trump administration" — the Signalgate scandal. The incident began when National Security Adviser Mike Waltz accidentally added Atlantic editor-in-chief Jeffrey Goldberg to a Signal group containing 18 senior U.S. officials, where Secretary of Defense Pete Hegseth subsequently posted detailed war plans for a drone strike in Yemen minutes before the attack actually happened. Lee's DEF CON 33 presentation traces the full technical arc of the saga: from the initial operational security (OPSEC) blunder, through the discovery that officials were using an Israeli-developed fork of Signal called TeleMessage (TM SGNL), to the trivial exploitation of that app's archive server — and the resulting 384 GB of leaked heap dump files that exposed plaintext government communications.

Background

▶ Watch: The incident: senior officials accidentally added journalist to classified Si... (2:14)

Signal is widely regarded as one of the most secure messaging applications available to civilians. Its end-to-end encryption, open-source codebase, and minimal metadata retention make it a gold standard for private communications. However, Lee emphasized that even the best cryptographic tool can be completely undermined by poor operational security practices — and Signalgate is a case study in precisely that failure.

The relevant legal context involves the Federal Records Act, which requires U.S. government officials to preserve official communications. The Signal group used by the Trump administration had "disappearing messages" enabled, likely placing its members in violation of federal records preservation law. Adding to the legal exposure, both Director of National Intelligence Tulsi Gabbard and CIA Director John Ratcliffe testified before congressional intelligence committees that no classified information was discussed in the group — a claim directly contradicted by the subsequently published message screenshots, and later confirmed false by a Washington Post report citing an internal White House investigation.

The root cause of Goldberg's accidental inclusion traces to a Siri contact-merge event: Goldberg had emailed the Trump campaign in October 2024, his phone number appearing in his email signature. That email was forwarded to Brian Hughes, Trump's campaign spokesperson. When Hughes' contact card was synced on Mike Waltz's iPhone, Siri appended Goldberg's number to it. Months later, when Waltz created the war-planning Signal group and tried to add Hughes — now the NSC's spokesperson — he inadvertently added Goldberg instead. This failure would not have occurred had officials used dedicated classified-communications devices rather than personal iPhones.

Key Findings

▶ Watch: Key finding: officials were using TeleMessage's Signal fork (TM SGNL), not re... (13:20)

The first major technical finding of the research concerned TeleMessage (TM SGNL), the app Mike Waltz was actually using when a Reuters photographer captured him checking his phone during a cabinet meeting on May 1st, 2025. Unlike the genuine Signal app, TM SGNL — developed by a company founded in Tel Aviv by former Israeli intelligence officers Guy Levit and Gil Shapiro — added archiving functionality on top of Signal's codebase. The app captures all incoming and outgoing Signal messages, stores them in a local SQLite database, and then forwards them over HTTPS to TeleMessage's archive server at archive.telemessage.com — in plaintext, before they ever reach the customer's designated corporate archive.

TeleMessage's own marketing claimed the product provided "end-to-end encryption from the mobile phone through to the corporate archive." Lee's analysis of the Android source code proved this to be false: messages are decrypted locally, written to SQLite, and then sent unencrypted to TeleMessage's server. The existence of plaintext messages inside Java heap dump files served as empirical proof of this misrepresentation.

A second critical finding involved the hard-coded credentials embedded in TM SGNL's Android source code. Variables named generate_talk_name and generate_talk_pass contained plaintext credentials for authenticating to a WordPress API used to submit debug logs — a startling security lapse for software used by government officials handling sensitive national security communications.

Technical Deep Dive

▶ Watch: TM SGNL is dramatically less secure than genuine Signal app (15:45)

The most significant vulnerability resided in TeleMessage's archive server. The server was built with Spring Boot, a popular Java application framework. Spring Boot includes a module called Actuator — a set of endpoints intended to help developers monitor and debug running applications. One of those endpoints, /actuator/heapdump, returns a Java heap dump file: essentially a 150 MB snapshot of everything held in the server's memory at the time the request is made.

Spring Boot's own documentation warns that "since endpoints may contain sensitive information, careful consideration should be given about when to expose them." Critically, the heap dump endpoint has been disabled by default since Spring Boot version 1.5, released in 2017. Yet archive.telemessage.com exposed it publicly, requiring no authentication whatsoever. Anyone who made an HTTP GET request to the full endpoint URL received a complete memory dump of the archive server.

An anonymous hacker discovered this endpoint by running the directory-brute-forcing tool Ferox Buster against the TeleMessage domain, having already noticed that the login page used ancient JSP (JavaServer Pages) technology and hashed passwords using MD5 on the client side. The entire process, according to the hacker, took approximately 15 to 20 minutes.

Once in possession of a heap dump file, the hacker ran the Unix strings command to extract all printable text from the binary file. Inside those strings were JSON objects containing plaintext Signal chat messages complete with sender and recipient phone numbers, group names, and full message content. The hacker searched for the string "password" and immediately found working credentials. Logging in to TeleMessage's admin panel as a U.S. Customs and Border Protection user, the hacker could see the names, phone numbers, and email addresses of 747 CBP members.

Lee himself analyzed the heap dump provided by the hacker. He wrote Python code to extract every intact JSON object from the strings output and load them into a SQLite database, then built an open-source web interface called "TeleMessage Explorer" for browsing the data. His code filtered out useless objects and identified distinct categories: chat messages (Signal, WhatsApp, Telegram, WeChat), user authentication records with email addresses and employers, and group membership data.

The total scale of the data set was revealed in May 2025 when a second hacker — apparently having downloaded a much larger cache before TeleMessage took its service offline — provided hundreds of gigabytes of heap dumps to Distributed Denial of Secrets (DDoSecrets), the nonprofit transparency collective. Lee converted 384 GB of binary heap dump files into 83 GB of searchable text by running strings across all files, enabling systematic analysis of the leaked data.

Demo / Proof of Concept

▶ Watch: TeleMessage hack: plaintext messages extracted from server in 20 minutes (19:50)

The exploit itself required no special tooling beyond Ferox Buster for discovery and a standard HTTP client for retrieval. The attack steps were:

1. Enumerate the archive.telemessage.com domain with Ferox Buster to locate .jsp files and any Spring Boot Actuator endpoints.
2. Identify the exposed /actuator/heapdump endpoint.
3. Issue a GET request to the endpoint — no authentication required — and receive a ~150 MB Java heap dump file.
4. Run strings on the heap dump to extract printable text.
5. Parse the output for JSON objects containing plaintext chat messages and credentials.
6. Use extracted credentials to access TeleMessage's administrative panel.

Lee demonstrated that the heap dump contained a message from a Galaxy Digital (GD Macro) cryptocurrency group discussing Senate Democratic co-sponsors of the GENIUS Act, illustrating that the intercepted communications spanned both government and financial sectors. The Washington DC Metropolitan Police Department's command staff WhatsApp group was also identifiable in the data.

Defensive Implications

▶ Watch: Data access: leaked archive distributed to journalists but not public (29:02)

The Signalgate saga contains multiple lessons for security practitioners across government and enterprise environments:

Dedicated devices for classified work. The Waltz contact-merge incident would not have occurred had officials used government-issued devices with separate contact databases for their sensitive communications, as established government policy already required.

Vendor security auditing before deployment. TeleMessage was deployed by senior U.S. government officials — apparently with no security review of the software. The hard-coded WordPress API credentials and the exposed Spring Boot Actuator endpoint are the kind of findings that appear in the first hour of any competent security assessment.

Spring Boot Actuator endpoint hardening. Organizations running Spring Boot applications must audit their Actuator endpoint exposure. The heap dump endpoint, disabled by default since 2017, should never be reachable from the public internet. A misconfiguration that has appeared on the Wiz cloud security firm's list of top Spring Boot misconfigurations was sufficient to expose the entire archive server's memory contents.

Verifying encryption claims. TeleMessage's marketing claimed end-to-end encryption "from the mobile phone through to the corporate archive." Source code analysis and the mere existence of plaintext messages in server-side heap dumps proved this was false. Organizations should require cryptographic proof of security claims, including third-party audits, before trusting sensitive communications to any provider.

Disappearing messages and records retention. Enabling disappearing messages on government devices likely violates federal records laws. Organizations must enforce communication retention policies at a platform level rather than relying on individual users to comply.

Key Takeaways

• Senior Trump administration officials conducted sensitive national security discussions over Signal on personal iPhones, inadvertently including a journalist through a Siri contact-merge error.
• The administration subsequently switched to TeleMessage's Signal fork (TM SGNL), which falsely claimed end-to-end encryption while silently forwarding plaintext messages to an archive server.
• TeleMessage's archive server was trivially exploitable: an unauthenticated HTTP GET request to an exposed Spring Boot Actuator /actuator/heapdump endpoint returned the server's entire memory, including plaintext chat logs and credentials.
• Two separate hackers independently discovered and exploited this vulnerability within days of the Reuters photo revealing Waltz's use of TM SGNL.
• DDoSecrets subsequently published 384 GB of heap dump files, covering communications from CBP agents, diplomatic staff, Secret Service members, and at least one White House staffer.
• TeleMessage's co-founders are alumni of Israeli intelligence units, raising counterintelligence questions that Senator Ron Wyden raised in a formal letter demanding a DOJ investigation.

About the Speaker(s)

▶ Watch: Scale: 71 government officials' communications exposed in the archive (38:14)

Micah Lee is an independent security researcher, journalist, and open-source developer. He is known for his work on secure communications and privacy-preserving technology, including contributions to Signal-related tools and operational security guidance. He has been a staff technologist at the Electronic Frontier Foundation and a founding board member of The Intercept. Lee is also a member of Distributed Denial of Secrets (DDoSecrets), the transparency collective that distributed the leaked TeleMessage data set. His analysis of TM SGNL's source code was cited by members of Congress, and his reporting on the TeleMessage hack appeared in 404 Media and Wired.