8 ms·
The article doesn't really say what hackers had access to, but it sounds like they had full control over their phones. There is a lot bigger story here and I'd
by milofeynman 7y ago
The article doesn't really say what hackers had access to, but it sounds like they had full control over their phones. There is a lot bigger story here and I'd love to read a post-mortem in a few months.
Also, WhatsApp is such an obvious target for a state actor. I saw several articles of the last year that mentioned Jared Kushner using Whatsapp so I assume a lot of government folks use it for off the books "encrypted" communication.
- vocatus_gate 7y agoA buddy of mine is Special Forces (U.S.). He said JSOC recently banned use of WhatsApp and encouraged everyone to switch to the open-source Signal (another encrypted messaging app). Allegedly WhatsApp uses Signal's encryption (OpenWhisper) but I stopped trusting it the second Facebook bought them out.
- akerro 7y ago>y banned use of WhatsApp and encouraged everyone to switch to the open-source Signal (another encrypted messaging app) Oversimplification: WhatsApp is based on Signal, but repurposed for Facebook.
- chriselles 7y agoApprox 20 months ago, numerous people I had contact with working in western military special operations units dropped WhatsApp in a fairly brief period of time.
- raincom 7y agoInteresting. I think, FB matches whatsapp numbers with fb profiles and other meta data.
- soulofmischief 7y agoFacebook didn't buy Signal. One of the original executives from Facebook left to help start the Signal foundation with Moxie precisely because he had become sick of Facebook's insane behavior.
- snazz 7y agoI think you misinterpreted the parent comment—I read it to mean that they stopped trusting WhatsApp as soon as Facebook bought them despite using the same technology as Signal. Your interpretation might be right, though.
- vocatus_gate 7y agoNo, you're correct. I stopped trusting WhatsApp after the Facebook acquisition.
- dchest 7y agoFYI, WhatsApp added end-to-end encryption after Facebook acquisition.
- milofeynman 7y agoI have been using signal for awhile and I try to convince people to use it, however I'm curious if using signal would have prevented this. It sounds like they got into WhatsApp servers and then did something else to get full access to people's phones.
- dan-robertson 7y agoIf one assumes that WhatsApp are implementing the protocol as well as signal are (which I do), then I think there are three questions in deciding what is more secure: 1. Do you trust Facebook (or open whisper systems) with your metadata/expect them to delete it? 2. How likely are there to be bugs (in the app, not in the protocol itself) which lead to exploits. On the one hand WhatsApp probably have more people working on the app and likely more security people too. On the other hand they may be pushed to add more features and having lots of code churn may introduce security holes. 3. How much work will be put into exploiting each app. On the one hand more people use WhatsApp but on the other, I guess security conscious people may be more likely to use signal. A known exploit to WhatsApp happened due to 2 with a bug in how audio calls were initiated. I don’t really have a good guess as to how the apps compare on points 2 and 3 but I guess WhatsApp loses on 1. A more practical point is that it’s likely easier to convince someone to use WhatsApp than signal, especially for group chat.
- wyldfire 7y agoWhatsApp will rekey and send old messages without notifying the user. This means MITM is possible and not always detectable. This is their intended design (but you can change the preference so that you at least get notified when it happens). (Widely reported, see Guardian article)
- dan-robertson 7y agoThat guardian article was pretty bad. It scared a lot of people from WhatsApp (which is still in general mode secure than most options) to text messaging by claiming that this was somehow some huge security flaw. From WhatsApp’s point of view this was a reasonable ux trade off. It is a major pain point of signal when it does this (particularly in group chats where it is more likely to happen). But I agree that from a strict security focused point of view this is a disadvantage to WhatsApp.
- rndgermandude 7y agoSorry, but his is a major security flaw. WhatApp, their mothership Facebook, or any party who can coerce them into doing so (e.g. the US government), can use this to rekey targets with their own keys, virtually undetectable by most regular users, thereby completely MITMing the message exchanges. Even moxie, who created this stuff, more or less admitted this[0], by saying the rekeying notification is the only defense, but that one is off by default in whatapp last I checked (which moxie confirmed[1]), which makes whatapp insecure by default at the very least. I wouldn't be surprised if WhatApp servers know if this notification setting is on or off, which would enable them to e.g. target people with insecure default settings only to avoid detection. I already said this in [0], but let's repeat it: This is essentially the same as if a webbrowser would just accept any TLS certificate without showing a warning no matter if valid or the issuer trust. Sure, this is hard problem to solve UX-wise and user-education-wise, but that doesn't excuse that you advertise your known-and-deliberately-insecure-by-default default-MITMable product as "secure communication using end-to-end encryption". [0] https://news.ycombinator.com/item?id=13395869 https://news.ycombinator.com/item?id=13395869 [1] https://news.ycombinator.com/item?id=13396393 https://news.ycombinator.com/item?id=13396393
- e12e 7y ago> Allegedly WhatsApp uses Signal's encryption (OpenWhisper About the partnership: https://signal.org/blog/whatsapp-complete/ https://signal.org/blog/whatsapp-complete/ But of course, in this case the issue seems to be either compromise of the device(s) via zero days, whatsapp usage simply being the target matrix - and/or a leveraging a zero day in whatsapp for full device compromise. It's unlikely signal would be immune - they didn't Crack the encryption, they cracked the app/os. In olden times the vector might have been a font, or a gif. The only advantage signal has is a conservative interface and small userbase. I'm not sure if they do some kind of hard-line whitelisting of attachments though - if you can pack an exploit as a file, I'm pretty sure you could send it via signal.
- tal8d 7y ago> The only advantage signal has is a conservative interface and small userbase. Signal is open source, WhatsApp is not. So how did you determine Signal has only one advantage over WhatsApp, without access to the WhatsApp source code?
- e12e 7y agoAdvantage in terms of security vulnerabilities - evidence seems to indicate that having the source code available isn't a big factor in reducing zero days. In addition, signal isn't any more protected against a rooted device. Nothing seems to indicate a back door here.
- riazrizvi 7y agoIt says the hackers had access to WhatsApp servers, so they can tell who is talking to whom, and depending on how WhatsApp does encryption they may have been able to decrypt messages. I say may, because WhatsApp had pitched itself as an encrypted messaging system, though personally I’d bet they could because it’s easy to claim your service is encrypted and yet still design backdoors for yourself.
- roywiggins 7y agoThe article is garbling the WhatsApp allegations: WhatsApp says the hackers abused WhatsApp servers to hack phones, not that the servers had a flaw. To send the malicious payloads to the victims, the hackers sent messages that flowed over WhatsApp's networks, which largely what they're hanging the lawsuit on. https://context-cdn.washingtonpost.com/notes/prod/default/documents/bf5edf35-5672-49fa-aca1-edefadff683f/note/8ef25c0d-fee9-416a-b7f9-e0a4dedc66f2.pdf https://context-cdn.washingtonpost.com/notes/prod/default/do... The actual flaw was this one: https://nvd.nist.gov/vuln/detail/CVE-2019-3568 https://nvd.nist.gov/vuln/detail/CVE-2019-3568
- dan-robertson 7y agoBased on the U.K. news, approximately everyone in parliament uses WhatsApp to talk/scheme with one another
- casefields 7y agoNot just the UK, most international diplomacy is done through Whatsapp: https://www.theguardian.com/technology/2016/nov/04/why-do-diplomats-use-this-alien-whatsapp-emoji-for-vladimir-putin https://www.theguardian.com/technology/2016/nov/04/why-do-di...
- inglor 7y agoNSO still have multiple ubpatched 0 days in WhatsApp Telegram and most other messaging apps. Your best bet is to use something obscure so you cannot easily be targeted or not being connected to the same net. At the Israeli army we had phones that ran completely separate software stacks and talked to a different network for this. Nothing was on the internet.
- inglor 7y agoAlso since modem stacks are so terrible - ideally two phones where one is just a hotspot for the other one and the one using the hotspot does not have a cellular modem. Also ideally not Android or iOS. Of course it is better to not be on the public internet with any sensitive device if at all possible. Anything on the internet is considered public.
- eru 7y agoSecurity by using obscure software has its own problems, alas. You have less eyeballs looking for exploits on the good guys side as well. So problems stay open.
- wolco 7y agoThe more obsure and different the less likely. If closed source the knowledge belongs to the creators. If the circle is extremely small the chance of that knowledge being shared with your enemy is low. It goes up when that circle is increased. When you want the biggest circle open source is safer. If your circle is small closed will be safer.
- eru 7y agoYour enemy can often learn those secrets not by being shared, but by other means. Eg reverse engineering. But in any case, the original comment was using 'obscure' in the sense of uncommon not in the sense of 'secret'. As far as I can tell.
- egeozcan 7y agoWithin my experience, security by obscurity works only if you're low profile. If significant amounts of money will be spent decrypting your mess, it's game over. OTOH, we usually only hear about the failed attempts, so there's a selection bias.
- dheera 7y agoThis is why I've been telling everyone that WhatsApp end-to-end encryption is moot if the client isn't open-source. Nobody listens though, until something like this happens.