5 ms·
But I thought WhatsApp was end-to-end encrypted?
by freeplay 7y ago
But I thought WhatsApp was end-to-end encrypted?
- sillysaurusx 7y agoE2E provides protection against the server provider knowing your content. It doesn't protect either end, since that would be impossible. In this case, it seems like WhatsApp itself was compromised; malware was distributed through the server directly to the app, or something along those lines. (Y'know how you can dynamically change apps nowadays using Codepush, etc? If Whatsapp had something like that in their pipeline, and that thing was compromised, and that compromise could be targeted at specific devices, then no amount of encryption can save you.)
- roywiggins 7y agoMy understanding is it was this buffer overflow vulnerability: https://nvd.nist.gov/vuln/detail/CVE-2019-3568 https://nvd.nist.gov/vuln/detail/CVE-2019-3568
- beentheretwice 7y agoThey exploited the app to take over the phone through a vulnerability
- ActorNightly 7y agoMessages probably are, the app itself may have openings that allow an attacker to see messages. In the early days of android, it was also possible to have a rogue google update service on a wifi AP, so when android connected to it you could push an update with malware.
- roywiggins 7y agoWhatsApp- the app- is the end. They pwned the app itself.
- mikece 7y agoIf you want secure your top choices, in my opinion, are Signal and Wire -- and I like Wire better because I can sign up with a burner account or seemingly random alias on my ProtonMail account. But don't just take my word for it -- here's a good place to start your own research: https://www.securemessagingapps.com/ https://www.securemessagingapps.com/
- est31 7y agoIt is, but when you create a new contact you are trusting the WhatsApp service that the public key of the other party actually is their public key. The service can always give both parties a key of their own making instead of the actual keys of the parties. IIRC you can verify the public keys via QR codes but maybe such verification wasn't part of security practices. Thus if you hack the service, you may be able to read messages even though it's supposed to be end-to-end encrypted. Another possibility is them faking a public annoucement to all Whatsapp users about some update or something. That announcement could then contain an image that exploits a vulnerability in the operating system's image decoder libraries. Or something like that. Without further information you can only speculate, but what's certain is that hacking the WhatsApp servers gives them ways to hack the phones that they previously didn't have.
- roywiggins 7y agoThis case is much simpler than that: there was a buffer overflow exploited in WhatsApp clients. https://nvd.nist.gov/vuln/detail/CVE-2019-3568 https://nvd.nist.gov/vuln/detail/CVE-2019-3568
- octorian 7y agoYeah, the exploit has absolutely nothing at all to do with message encryption. It's just your run-of-the-mill security hole that happens in other software all the time. As such, most of the comments in this thread are completely off base. What makes it notable is which app it was found in, the reach of that app's userbase, and that a company was selling these exploit services.
- est31 7y agoOh thanks, this wasn't mentioned in the linked article.
- roywiggins 7y agoSkimming the actual complaint (unhelpfully, not linked by the article) clears a lot up about what happened. https://context-cdn.washingtonpost.com/notes/prod/default/documents/bf5edf35-5672-49fa-aca1-edefadff683f/note/8ef25c0d-fee9-416a-b7f9-e0a4dedc66f2.pdf https://context-cdn.washingtonpost.com/notes/prod/default/do...
- lawzup 7y agoYeah