4 ms·
It is, but when you create a new contact you are trusting the WhatsApp service that the public key of the other party actually is their public key. The service
by est31 7y ago
It is, but when you create a new contact you are trusting the WhatsApp service that the public key of the other party actually is their public key. The service can always give both parties a key of their own making instead of the actual keys of the parties. IIRC you can verify the public keys via QR codes but maybe such verification wasn't part of security practices. Thus if you hack the service, you may be able to read messages even though it's supposed to be end-to-end encrypted.
Another possibility is them faking a public annoucement to all Whatsapp users about some update or something. That announcement could then contain an image that exploits a vulnerability in the operating system's image decoder libraries. Or something like that. Without further information you can only speculate, but what's certain is that hacking the WhatsApp servers gives them ways to hack the phones that they previously didn't have.
- roywiggins 7y agoThis case is much simpler than that: there was a buffer overflow exploited in WhatsApp clients. https://nvd.nist.gov/vuln/detail/CVE-2019-3568 https://nvd.nist.gov/vuln/detail/CVE-2019-3568
- octorian 7y agoYeah, the exploit has absolutely nothing at all to do with message encryption. It's just your run-of-the-mill security hole that happens in other software all the time. As such, most of the comments in this thread are completely off base. What makes it notable is which app it was found in, the reach of that app's userbase, and that a company was selling these exploit services.
- est31 7y agoOh thanks, this wasn't mentioned in the linked article.
- roywiggins 7y agoSkimming the actual complaint (unhelpfully, not linked by the article) clears a lot up about what happened. https://context-cdn.washingtonpost.com/notes/prod/default/documents/bf5edf35-5672-49fa-aca1-edefadff683f/note/8ef25c0d-fee9-416a-b7f9-e0a4dedc66f2.pdf https://context-cdn.washingtonpost.com/notes/prod/default/do...