20 ms·
NSO hacked WhatsApp to spy on top government officials at U.S. allies
- TaylorAlexander 7y ago“WhatsApp did not identify the clients of NSO Group, who ultimately chose the targets.”
- tareqak 7y agohttps://news.ycombinator.com/item?id=21411403 https://news.ycombinator.com/item?id=21411403 is a later post, but uses the original title.
- deleted 7y ago[deleted]
- cloudyo 7y agoSometimes you just feel like using Signal instead
- maxton 7y agoWho's to say Signal will protect you any better against targeted remote-code-execution attacks from well-funded cyber mercenaries like NSO?
- stjohnswarts 7y agoHow many people actually worry about these spy agencies? If a state actor wants you or your information they'll just pull up in a black van and take you and use a $5 wrench to beat it out of you.
- criley2 7y agoI get the implication but America isn't Russia and they just don't do it, too big of a headache, too easy to blowback into political realm. Officers hate when clandestine work erupts into public political drama. Plus, why would you hire a team of people to kidnap a citizen and beat them when you can assign a ticket to a government blackhat at the NSA who will run the commands against your devices and take what they need without you ever knowing. Even then, there is substantial risk of whistleblowing for illegal data collection against citizens (Snowden et al) so they would instead in a clandestine manner ask a fellow member of the Five Eyes to perform the surveillance "legally". Our society has known about Five Eye roundabout spy agreements for a long time and has largely shrugged, so the risk of public political blowback doing this would be minimal.
- lashkari 7y agoI get your point that a highly-motivated attacker has other, less sophisticated, ways of getting to your data. However, if we're playing poker and I learn your tell, it's in my best interest that you are naive to that fact. While not the best analogy, I would think that the same concept would apply to state actors.
- goatsi 7y agoThe state actor will have a more difficult time doing that if you are living in a different country. Exploits don't care about borders: https://www.voanews.com/africa/ethiopia-accused-using-spyware-against-citizens-living-abroad https://www.voanews.com/africa/ethiopia-accused-using-spywar...
- roywiggins 7y agoMuch of what NSO Group does is sell to smaller despotic regimes who then use them to spy on dissidents who live abroad and would be quite hard (and embarrassing) to black-bag. Not everyone can send a murder team to Stockholm (or wherever). Some despotic regimes do have large kidnap-and-murder programs (ex Rwanda) but if you just want to keep tabs on exiled dissidents and learn exactly who they're talking with back home, NSO Group has a product for you.
- JohnFen 7y ago> How many people actually worry about these spy agencies? I don't really worry about the spy agencies themselves -- I am not of any interest to them. However, I worry a lot about the likes of NSO and the tools they produce. They are likely to end up being used, in one form or another, by criminals and corporations.
- wp381640 7y agoThese tools keep authoritarians in power and indirectly impact hundres of millions of people. It's like saying you don't care about pacific ocean plastic because you live on the east coast.
- heavenlyblue 7y agoHow’s that different from selling weapons to them, though?
- wp381640 7y agoIt's not - we shouldn't be selling weapons to them either. Ditto with sharing intel. Sanctions on selling exploits seems easier to achieve though since there is less of a conflict with economic interests
- JohnFen 7y ago> These tools keep authoritarians in power Indeed. I think I covered that in "criminal" category, but perhaps I should have been more explicit.
- peatmoss 7y agoYeah, I pretty much assume that targeted attacks will always succeed when a well-funded state actor is involved. For me, I look at encryption as a mitigation for surveillance. Anything that increases the marginal cost to monitor an individual makes broad surveillance less economic. Signal will always have the edge for surveillance due to the relative difficulty of hiding a back door. Whatsapp will always be suspect in that they could easily be forwarding everyone’s messages to third parties.
- blotter_paper 7y agoI mean, Signal is open source and not owned by Facebook, so I'm not sure why anybody uses WhatsApp instead.
- vocatus_gate 7y agoIt's a much better app, user experience-wise. I prefer Signal for obvious reasons, but WhatsApp is easier to use (and has a much better web interface).
- Canada 7y agoI agree, but when the people you want to talk to are on WhatsApp already...
- maximente 7y agothey have features signal has not yet copied and probably won't (statuses e.g.)
- dylan604 7y agoThe main one being actual users
- shantly 7y agoLast I checked Signal's UX was worse enough that I'd be fighting a real uphill battle to get my friend group to switch.
- blotter_paper 7y agoThat's reasonable, I suppose I'm lucky to have a friend group that universally prefers open source sorftware to good UX -- there was never really a question for us.
- smeyer 7y agoIt's a little eye opening to me that anyone could have a friend group that "universally prefers open source software to good UX". I have and use Signal with some friends, but there are also loads of people I communicate with who couldn't even tell you what open source software is, let alone articulate a preference for it over good UX. Are all of your friends software engineers and/or technophiles?
- godelski 7y agoNot that I'm dissing Signal (it is my preferred platform, sadly not most used), but don't both WA and Signal use Open Whispers systems? So isn't there the potential that the same exploit might work on Signal?
- vocatus_gate 7y agoWhatsApp allegedly uses an implementation of the OpenWhisper encryption system that Signal created (and still uses). However as there is no source code available unlike Signal, there's no way to verify if WhatsApp "really" is using it (or using it correctly).
- kingbirdy 7y agoCouldn't you determine by looking at the code in the APK, at least for Android?
- e12e 7y agoYes, "no way to verify" is a bit strong. Not as easy to verify is true (but: if you review the source, you'd also have to build the app yourself).
- mosburger 7y agoIt might be a bit difficult (but not impossible) to do that... the APK you download is not the APK that the developer uploads to the Play store. Usually, developers upload a "bundle," and then Google optimizes it by stripping out irrelevant media, i18n, etc., to deliver a smaller optimized APK to the end user. So you can't just generate an MD5 of your APK and match it against the store description like the good old days when you could make sure your Linux ISO was legit, but there's probably some way to make it work? EDIT: It might be possible to circumvent Google's bundling/optimizing by just uploading a regular old APK, but IIRC that was becoming more difficult these days. Unfortunately I'm not an Android dev expert.
- godelski 7y agoThis is true, but that also doesn't answer the question. It still leads to a possibility. The hack could also sidestep OW in some other way and only be WA specific, but still begs the question. Security is a constant cat and mouse game, so if someone says: "well, that only affects WhatsApp, it won't affect us -- even though we use the same underlying structure." sounds kinda naive.
- milofeynman 7y agoWould this attack have been preventable with signal?
- nullc 7y agoSignal's software is timebombed to force you into taking automatic updates. These updates could be used to force targeted users into backdoored builds. Additionally, the signal has had a long history of being feature hostile to strongly secure use, through things like making it very difficult to cryptographically verify the identity of the party you're talking to... or automatically resending the last message you sent when the far end merely claims its key has changed. I recommend people treat signal as unencrypted communications-- _actually_ unencrypted private communications are too absurdly insecure to use. But in practice signal does not provide the kind of strong security that we would associate with 'encrypted communication', and maybe UI considerations make that an unrealistic goal. Instead signal provides the kind of security we should expect from _ANY_ communication, but which isn't actually provided due to pervasive surveillance.
- dependenttypes 7y agoThere have been a few electron vulnerabilities that affected signal. Plus signal demands that you have a phone number in order to use it. Also the fact that each device has its own key promotes the users to just blindly accept new keys.
- chadlavi 7y agoNo one who wants to talk securely should ever use a facebook-owned channel in the first place.
- gpm 7y agoIt depends who your adversaries are. It's one thing to say "they shouldn't use a facebook channel to talk securely", it's another to say "they shouldn't use a facebook channel on the same device as they use another channel to talk securely". My understanding of this was that it is the latter. Unfortunately people often don't have the luxury of doing the latter.
- dotancohen 7y ago> Unfortunately people often don't have the luxury of doing the latter. What? Just don't install the Facebook or other social apps. I do have Telegram, but no other social media apps on my phone. If you need to communicate, then SMS / MMS / telephone is fine. What can be done with Facebook that cannot be done with normal SMS or MMS or phone calls or video calls?
- pmoriarty 7y agoThe Facebook app came pre-installed on my Android phone, and I couldn't get rid of it without rooting my phone (which would make it less secure).
- e12e 7y agoSad to see you're downvoted. The state of open source on Android is quite dire - it's difficult to run a fully patched ASOP - and the alternative is "customized" os installs with tons of crap. If nothing else, the more code that runs, the more bugs to exploit.
- gpm 7y agoI also don't have any facebook apps on my phone - but from what I understand there are countries where whatsapp is how a lot of business is done. If you can't afford the time and opportunity cost of avoiding those businesses you have to install it.
- denzil_correa 7y ago> Sources familiar with WhatsApp’s internal investigation into the breach said a “significant” portion of the known victims are high-profile government and military officials spread across at least 20 countries on five continents. Welp!
- 3pt14159 7y agoI know a military contractor working on stuff for non-Nato airforces. These guys use WattsApp for everything. It blew my mind.
- jacquesm 7y agoI sincerely hope you are joking but from what I've seen myself it would not surprise me at all.
- 3pt14159 7y agoNope. I wish it were a joke. Now this stuff isn't modern gear on F35s (think testing benches, displays, meetings, etc) but it's still horrific.
- inglor 7y agoFun fact, a few of my friends and even family work for NSO and until recently they used WhatsApp for their own internal communication. They literally moved off it a few days ago when shit hit the fan into more secure software because Facebook is targeting NSO employees.
- cloudyo 7y agoWelcome, Signal
- otachack 7y agoAlso Keybase And Telegram (need to enable e2e for a given conversation, though)
- milofeynman 7y agoThe article doesn't really say what hackers had access to, but it sounds like they had full control over their phones. There is a lot bigger story here and I'd love to read a post-mortem in a few months. Also, WhatsApp is such an obvious target for a state actor. I saw several articles of the last year that mentioned Jared Kushner using Whatsapp so I assume a lot of government folks use it for off the books "encrypted" communication.
- vocatus_gate 7y agoA buddy of mine is Special Forces (U.S.). He said JSOC recently banned use of WhatsApp and encouraged everyone to switch to the open-source Signal (another encrypted messaging app). Allegedly WhatsApp uses Signal's encryption (OpenWhisper) but I stopped trusting it the second Facebook bought them out.
- akerro 7y ago>y banned use of WhatsApp and encouraged everyone to switch to the open-source Signal (another encrypted messaging app) Oversimplification: WhatsApp is based on Signal, but repurposed for Facebook.
- chriselles 7y agoApprox 20 months ago, numerous people I had contact with working in western military special operations units dropped WhatsApp in a fairly brief period of time.
- raincom 7y agoInteresting. I think, FB matches whatsapp numbers with fb profiles and other meta data.
- soulofmischief 7y agoFacebook didn't buy Signal. One of the original executives from Facebook left to help start the Signal foundation with Moxie precisely because he had become sick of Facebook's insane behavior.
- deleted 7y ago[deleted]
- knolax 7y agoThe media and popular reaction to this seems really milquetoast compared to when Russia/China/North Korea/Iran do the same thing. How long before it becomes mainstream to treat Israel as a bogeyman?
- d47gktid 7y agoThis seems like a disinformation campaign aimed at diverting attention from the fact that the governments of the human rights activists, human rights lawyers themselves used pegasus from NSO to target them. Many of the Indian activists, journalists, lawyers who were targeted are working for low caste victims of false cases filed against them. John from Citizen Lab personally called them and told 'Your government attacked you'[0]. If anyone from Citizen Lab/WhatsApp is reading this, please corroborate with evidence that the governments themselves spied on its citizens when these activists sue them in court. [0]: https://scroll.in/latest/942218/nagpur-lawyer-notified-by-whatsapp-of-surveillance-says-bhima-koregaon-accused-were-also-targetted https://scroll.in/latest/942218/nagpur-lawyer-notified-by-wh...
- qtplatypus 7y agoHow is this disinformation? The story says that NSO was used to target human rights advocates.
- rshnotsecure 7y agoDozens of tech companies around the world that were established in the last 4-5 years were done so entirely for the purpose of being fronts for spy agencies to engage in the vast collection of data. This extends also to shipping, licensing, and auditing companies. One example is https://www.pacificbasin.com/en/fleet/fleet.php https://www.pacificbasin.com/en/fleet/fleet.php Somehow they’ve managed to assemble the worlds 2nd largest cargo fleet in terms of dry weight tonnage, all verifiable on https://marinetraffic.com https://marinetraffic.com btw, and yet they appear on NO LISTING ANYWHERE for the top 100 cargo companies. That company is a front for the Chinese military, because if you do a reverse WHOIS search you will see http://pacbasin.com http://pacbasin.com was also registered by the same organization...it is an autonomous drone hardware and extended flight operations firm. There is more to say there, but I will leave it at that. Other firms that have been espionage operations since day one, or were acquired at some point and repurposed as spy outfits. This list includes both Western and Eastern powers: NSFOCUS Global psychz.net mimecast.com terra.net protonmail.com creditkarma.com ipvm.com ClearDDOS Neuvector Multacom HighWinds Black Oak Computers IT7 Networks Ramnode Gorilla Servers Digital Core InMotion Hosting Choopa LeaseWeb StackPath Voxility Perfect International
- galazzah 7y agoCan you provide any sources? Surprised to see Credit Karma on here...
- sergiomattei 7y agoThis. It's easy to come on places and spew conspiracy theories, but this is a really heavy accusation to many reputable companies. Back it up or nothin'.
- rshnotsecure 7y agoIt comes mainly from mapping the subdomains over time and analysis of the ASNs. This is key. You will often see a company with perhaps 200 or so subdomains, that only does business in the United States. But then you will see one subdomain that maps to ASN 4803 or whatever, which then leads to “China Telecom xinjiang”. In fact I encourage you to type: org:”China Telecom xinjiang” “NSFOCUS” into Shodan. Also look at the capital expenditures psychz.net claims on their about page. There is no IaaS company in the world that can afford to lay down as much hardware as they are claiming. Another thing btw is these sites never seem to have job openings. That is common pattern that applies to perhaps 60% of the firms listed.
- blotter_paper 7y agoWhich is hilarious and hypocritical, since the government keeps talking about making end-to-end encryption apps illegal to distribute without backdoors. Now they're using an encryption app with a backdoor,* and they're upset about it? I thought this is what they wanted! *I know, I know, this probably wasn't done with a backdoor -- it's just funnier to lie in this context.
- chatmasta 7y agoIn fact, demonstrating this point is probably part of the reason Facebook is litigating this case. It gives them a solid example of the risks of backdoors that they can point to when governments ask for them.
- K0SM0S 7y agoThere's a nice plot stemming from there. “A rogue big tech employee puts on a grey hat to orchestrate a hack + personal blackmail on government officials, to instill a deep fear out of them and make them realize the folly of refusing end-to-end encryption.”
- mlthoughts2018 7y agoMr Robot season 5
- criley2 7y agoThe real irony comes from an Administration who ran on the odious idea of "locking up" government employees who mishandled communications, who then turns around and begins a mass campaign of mishandling communications...
- barkingcat 7y ago"You're doing mishandling of communications wrong. Here, let me show you how to really mishandle communications."
- 7y ago
- freeplay 7y agoBut I thought WhatsApp was end-to-end encrypted?
- sillysaurusx 7y agoE2E provides protection against the server provider knowing your content. It doesn't protect either end, since that would be impossible. In this case, it seems like WhatsApp itself was compromised; malware was distributed through the server directly to the app, or something along those lines. (Y'know how you can dynamically change apps nowadays using Codepush, etc? If Whatsapp had something like that in their pipeline, and that thing was compromised, and that compromise could be targeted at specific devices, then no amount of encryption can save you.)
- roywiggins 7y agoMy understanding is it was this buffer overflow vulnerability: https://nvd.nist.gov/vuln/detail/CVE-2019-3568 https://nvd.nist.gov/vuln/detail/CVE-2019-3568
- beentheretwice 7y agoThey exploited the app to take over the phone through a vulnerability
- ActorNightly 7y agoMessages probably are, the app itself may have openings that allow an attacker to see messages. In the early days of android, it was also possible to have a rogue google update service on a wifi AP, so when android connected to it you could push an update with malware.
- roywiggins 7y agoWhatsApp- the app- is the end. They pwned the app itself.
- mikece 7y agoIf you want secure your top choices, in my opinion, are Signal and Wire -- and I like Wire better because I can sign up with a burner account or seemingly random alias on my ProtonMail account. But don't just take my word for it -- here's a good place to start your own research: https://www.securemessagingapps.com/ https://www.securemessagingapps.com/
- rattray 7y agoThe article claims that "a flaw in WhatsApp-owned servers" was used to "take over users’ phones". This seems to imply that the hackers were able to escape from the WhatsApp mobile app to perform other actions on the phones. How would this be possible? Or is this just likely careless journalism, and the exploit was that the server breach allowed the attackers to exfiltrate WhatsApp data only?
- d47gktid 7y agoIt was done using pegasus exploit from NSO. A missed video call to the target on WhatsApp was all that necessary to deliver the payload, escape the sandbox & exploit the operating system. What WhatsApp & CitizenLab said to the victims in India about the attack[0]. [0]: https://scroll.in/latest/942218/nagpur-lawyer-notified-by-whatsapp-of-surveillance-says-bhima-koregaon-accused-were-also-targetted https://scroll.in/latest/942218/nagpur-lawyer-notified-by-wh...
- JumpCrisscross 7y ago> How would this be possible? Anecdotally, from a friend at WhatsApp, their engineering has been distracted by integration with Facebook. Holes that would have been patched in an independent WhatsApp may have been left to fester in the-now Facebookdivision.
- chatmasta 7y agoI think OP is asking how NSO was able to escape the phone's sandbox model. To do that, they would need an exploit for the phone's OS, in addition to the WhatsApp exploit. So, the obvious question: which operating systems were specifically targeted? Another comment mentions Pegasus... that was an iOS exploit patched in 9.3.5 (3 years ago). Does that line up with the timeline of this article? Given that Android exploits are far more common than iOS, I would expect they had one of those too. But then, where are Apple and Google in this case? It wasn't solely Facebook who was exploited; their app was just the initial vector to escalate to an attack on the OS. NSO probably could have achieved the same with dozens of other apps, but WhatsApp was chosen because of ease of deliverability (messaging) and popularity.
- beentheretwice 7y agoThats really funny because a friend of mine used to work there and always talked about how all the internal very classified communication was done via whatsapp!
- e12e 7y agoCitizen labs write-up: https://citizenlab.ca/2019/10/nso-q-cyber-technologies-100-new-abuse-cases/ https://citizenlab.ca/2019/10/nso-q-cyber-technologies-100-n...
- eternalban 7y agoThe name of the company is "NSO Group". NSO is too close to NSA. Please correct it.
- laegooose 7y agoI hate facebook just like everyone else, but doesn't it have more resources to spend on WhatsApp security than Signal Foundation? Yes, Signal is open-source, but how many people are actually looking for its vulnerabilities full-time?
- callalex 7y agoJust because Facebook can doesn’t mean they will. Justifying security research budgets is notoriously difficult in the corporate world.
- feelthepress 7y agoEarlier this month the DOJ asked Facebook to "halt end-to-end encryption" by adding a backdoor to all of Facebook's apps. Perhaps this is a reason. https://www.engadget.com/2019/10/03/doj-facebook-end-to-end-encryption-whatsapp-instagram-messenger/ https://www.engadget.com/2019/10/03/doj-facebook-end-to-end-...
- buboard 7y agoI m confused, the top government officials are the children or the predators?
- beagle3 7y agoThe answer is yes.
- RaiseProfits 7y agoWhy would facebook comply?
- tomcooks 7y agoWhy wouldn't a company of that size comply?
- RaiseProfits 7y agoIt’s an unnecessary cost and hurts whatever brand value remains.
- x220 7y agoFacebook is already given the NSA instant access to all their significant user data. Do you think they're doing that for free?
- markus_zhang 7y agoIsrael has some companies who are really good at this. I recall a story about the Saudis purchasing service from some Israeli companies to spy on other's cellphones.
- mmanfrin 7y agoThat was literally NSO. They were the company that gave the Saudi's access to Jamal Khashoggi's phone.
- deleted 7y ago[deleted]
- jonplackett 7y agoWhat are Israel doing to get so good at this and chip design and weapons making and everything else they seem to be really good at? There’s only about 8 million people in the whole country. There are plenty of cities with more people than that. How come they punch so far above their weight?
- elorant 7y agoI guess it's part of their mentality. Just take a look at how many Jewish people have won the Nobel prize. Sure, most of them weren't even Israelis, but it seems that intellectual prowess is part of their heritage. https://en.wikipedia.org/wiki/List_of_Jewish_Nobel_laureates https://en.wikipedia.org/wiki/List_of_Jewish_Nobel_laureates
- Scarbutt 7y agoLots and lots of outside money.
- kd3 7y agoYep especially US "aid".
- acruns 7y agoOther countries off-shoring their spycraft. <cough> <cough>
- xenospn 7y agoIsrael got about a million highly educated ex-Soviet immigrants who kick started the hi-tech industry in the early 90s. It’s slowly declining tho as Israel focuses more on educating kids about their “Jewish identity” than science and technology.
- deleted 7y ago[deleted]
- nullc 7y agoMy experience with Israeli companies suggests that a culture which values intellectual achievement and competition is more widespread there. Similar cultural enclaves exist elsewhere in the world and are presumably similarly effective, but they just aren't as large a portion of the population. Even small cultural differences can have outsized effects because of pollination-- e.g. it's easier to learn from an expert in a domain if there are more experts around you. I think your question isn't really that much different to asking why the bay area has "punched above its weight" in terms of producing successful tech companies compared to other regions around the US... or why other regions have had a lot more success in other domains.
- tomcooks 7y agoUse Matrix (Riot.im is a great client) Or Signal, but without the phone number signup
- antpls 7y agoFrom what I read, NSO didn't only hack Whatsapp, they also used vulnerabilities in the Android OS in the media decoder. Given all the CVEs patched on each Android security patch, that wouldn't be surprising. If that's the case, the articles are focusing too much on WhatsApp failure, but not enough on the failure of the Android OS. To me there is some kind of shared responsibility between the app and the OS here. Who knows how many CVEs are hiding in the Signal and Riot.im apps? And Riot.im asks for many permission...
- jokoon 7y agoHow do you sign up without a phone number?
- gyuserbti 7y agoOr Briar or Ricochet, or something developed in house. Honestly, the thing that's so perplexing to me is why so many people in these roles would be using Whatsapp at all for these things. It's like SoS mentality (to use an imperfect metaphor) run amok.
- misiti3780 7y agoHow people go to work at NSO Group, is beyond me. They must pay really well.
- lewiscollard 7y agoThe bad guys will find out first. Back when I first heard that, the bad guys were bored and/or hyperactive teenagers who understood how computers work. Today we are talking nation-state actors and nation-state-sponsored actors with practically unlimited resources. Keeping your code secret will not stop them, cf. WhatsApp. "Responsible disclosure" will not stop them either, and sets up all the wrong kinds of incentives for vendors to sit on problems until just before the "responsible" disclosure window closes. And FFS, there are still grown adults that believe building backdoors into E2E won't be exploited by the bad guys first, insofar as they are not the bad guys themselves. I only have questions, not answers, and I don't know what we do from here.
- nullandvoid 7y agoWe have to make this knowledge of closed source systems not being safe more wide spread more approachable to the lamen. It will take time but generations are slowly waking up to the bullshit. We need to be able to run open source code on servers in a transparent and reportable way that everyone can understand I see services like whatsapp taking the stance it is essential. Its the only place I (barely) feel like I can speak my mind when chatting with non tech savvy friends (of which it would be a hard sell to get to install anything else more rock solid). I really hope we can adopt widespread e2e encrypted chat platforms moving forward and dont regress in this front else it will be a sad future
- rapnie 7y agoAnybody using Oversec? I am not using it, but the concept sounds good. > Oversec constantly monitors the text on your screen. When it finds an encrypted text, it tries to decrypt it and then shows the decrypted text as an overlay in place of the encrypted text. > In order to encrypt a text, Oversec shows a button next to an active input field. After having entered the secret text, tapping that button makes Oversec read the text, encrypt it and put back the encrypted text into the field. It is now ready to be sent in the subjacent app as usual - the app doesn't even know that it is sending encrypted data! https://www.oversec.io/ https://www.oversec.io/ Edit: Created a separate submission at https://news.ycombinator.com/item?id=21414464 https://news.ycombinator.com/item?id=21414464
- inglor 7y agoDon't forget that some disgruntled employee stole the software a few years ago. So who knows who has access to this. https://m.calcalist.co.il/Article.aspx?guid=3741738 https://m.calcalist.co.il/Article.aspx?guid=3741738
- bbernoulli 7y agoReally wish I knew what this said
- lightedman 7y agohttps://translate.google.com/translate?hl=en&sl=auto&tl=en&u=https%3A%2F%2Fwww.calcalist.co.il%2Finternet%2Farticles%2F0%2C7340%2CL-3741738%2C00.html https://translate.google.com/translate?hl=en&sl=auto&tl=en&u... Here's a translated page.
- heyoni 7y agoThat website made my screen go black and my phone get hot!
- LilBytes 7y agoThat wasn't just me!?
- inglor 7y agoI am just confused that NSO are getting all the flak for this when there are many bigger players in the market (like Verint) peacefully happily doing the same thing for years. Of course, I don't think this particular report is correct (I am sure the US spies on its allies like all big countries but I doubt it would need NSO and given the US regulates the body that regulates who NSO is allowed to sell to - I doubt it)
- stopvendetta 7y agoAn interesting part to the story is Facebook's response - they decided to attack and punish individual NSO employees! https://news.ycombinator.com/item?id=21414845 https://news.ycombinator.com/item?id=21414845 This is unprecedented response.
- gesman 7y agoSo i wonder about a ways of implementing secure communications using untrusted device over untrusted channels.
- inglor 7y agoYou can just encrypt it before typing it down and send encrypted text so the cleartext is never on the device. It's just not convenient at all though theoretically this can be a separate device that is not connected to the internet.
- lawzup 7y agoOmg now whatsapp is also hacked, but how its possible bcoz whatsapp has 256 bit encryption
- limeman 7y agoI personally feel the protocol should be opensourced and security bugs should be fixed which are written in cpp for audio/video calls. Or the video or audio call process should be sandboxed and tightened api access
- kraf 7y agoWhat's the deal with the end-to-end encryption here, I don't understand. If you get control over the server, you can circumvent it with WhatsApp? How did the attackers get hold of the private keys?
- iicc 7y agohttps://news.ycombinator.com/item?id=21411312#21413086 https://news.ycombinator.com/item?id=21411312#21413086
- _trampeltier 7y ago"Prior to notifying victims, WhatsApp checked the target list against existing law enforcement requests for information relating to criminal investigations, such as terrorism or child exploitation cases. But the company found no overlap, said a person familiar with the matter. Governments can submit such requests for information to WhatsApp through an online portal the company maintains." There is already an official backdoor, or how should I understand that?
- sandworm101 7y agoYou have it correct. Nearly every major US provider maintains some sort of online interface for law enforcement to submit requests. The level of information provided via these means varies, but they are obligated to respond to legitimate requests with wharever data they have on hand. Dont like it? Go with a security-minded service like signal. Or, better yet, something totally severless and open source.
- _trampeltier 7y agoI don't use WhatsApp. But if they have an official backdoor, then it's not really e2e encrypted. Until now I thought, at least the official statement was, WhatsApp is truly e2e encrypted. Just that.
- sandworm101 7y agoMaybe they are. But they would still have non-content timing, location and connection data. That is just as useful as message content.
- secfirstmd 7y agoIsn't the fear more about a man-in-the-room attack rather than weaknesses in the e2e?
- y4mi 7y agoIt can be end to end and Encrypted and still have a backdoor. I.e keeping a continuous web client active which the user isn't notified about
- swiley 7y agoI’m shocked! I would have never expected this! Having a single organization so specialized in the particular domain handling nearly everyone’s data getting hacked? How ridiculous! Apple have single handedly done the internet a gross disservice by not making it easy for users to set up webhooks for push notifications. If it weren’t for that chat would have a chance at being sane.