5 ms·

Can somebody explain how was it possible to get whatsapp messages when it applies E2E encryption? Did they have physical access to the devices? Was it all remo

Can somebody explain how was it possible to get whatsapp messages when it applies E2E encryption? Did they have physical access to the devices? Was it all remote? Is it even feasible on an individual level and what would be the alternative(Signal? Telegram?)?

goatsi 8y ago
NSO has a 0 interaction remote iphone 0day. https://motherboard.vice.com/en_us/article/qvakb3/inside-nso-group-spyware-demo https://motherboard.vice.com/en_us/article/qvakb3/inside-nso... >The entrepreneur, who spoke to Motherboard on condition of anonymity because he was not authorized to talk about the meeting, agreed, but said that NSO would have to target his other iPhone, which he brought with him and had a foreign phone number. He gave NSO that phone number and put the phone on the desk. >After “five or seven minutes,” the contents of his phone’s screen appeared on a large display that was set up in the meeting room, all without him even clicking on a malicious link, he said. >“I see clicking on all kinds of icons: email icon, SMS icon, and other icons,” he told Motherboard. “And suddenly I saw all my messages in there and I saw all the email in there and they were capable to open any information that was on my [iPhone].”
fossuser 8y ago
It's unclear, but from the article it seems to suggest that his phone had bad software running on it and was recording keystrokes at the OS level. Encryption wouldn't help you in this case since you can just record the strokes (maybe see the screen) like the regular user would see. Not sure how they'd do this though, maybe he was using Android?
- TheForumTroll 8y ago
  It was an iPhone. They aren't safer than android you know. Just different.
  - fossuser 8y ago
    I think they generally are safer - Apple has a better security posture and tighter control over both the hardware and OS. Though not perfect clearly.
azernik 8y ago
Cryptography is a solved problem. Ignore the crypto, attack the endpoints. I assure you there are many many attacks out there for compromising iOS and Android that do not require physical access.
walrus01 8y ago
pwn the endpoint devices' operating systems and bootloaders.

goatsi 8y ago

NSO has a 0 interaction remote iphone 0day. https://motherboard.vice.com/en_us/article/qvakb3/inside-nso-group-spyware-demo https://motherboard.vice.com/en_us/article/qvakb3/inside-nso... >The entrepreneur, who spoke to Motherboard on condition of anonymity because he was not authorized to talk about the meeting, agreed, but said that NSO would have to target his other iPhone, which he brought with him and had a foreign phone number. He gave NSO that phone number and put the phone on the desk. >After “five or seven minutes,” the contents of his phone’s screen appeared on a large display that was set up in the meeting room, all without him even clicking on a malicious link, he said. >“I see clicking on all kinds of icons: email icon, SMS icon, and other icons,” he told Motherboard. “And suddenly I saw all my messages in there and I saw all the email in there and they were capable to open any information that was on my [iPhone].”

fossuser 8y ago

It's unclear, but from the article it seems to suggest that his phone had bad software running on it and was recording keystrokes at the OS level. Encryption wouldn't help you in this case since you can just record the strokes (maybe see the screen) like the regular user would see. Not sure how they'd do this though, maybe he was using Android?

TheForumTroll 8y ago
It was an iPhone. They aren't safer than android you know. Just different.
- fossuser 8y ago
  I think they generally are safer - Apple has a better security posture and tighter control over both the hardware and OS. Though not perfect clearly.

azernik 8y ago

Cryptography is a solved problem. Ignore the crypto, attack the endpoints. I assure you there are many many attacks out there for compromising iOS and Android that do not require physical access.

walrus01 8y ago

pwn the endpoint devices' operating systems and bootloaders.