4 ms·

No, they couldn't decrypt the file on Bezos' phone. Because they don't have the phone, or even the file. TFA actually says that clearly: > Remember that this

No, they couldn't decrypt the file on Bezos' phone. Because they don't have the phone, or even the file. TFA actually says that clearly: > Remember that this example is a video a friend sent to me, and not the original video sent by MBS to Bezos. But the same principle applies. Simply look in that file in the backup, extract the URL and mediakey, insert into this program, and you'll get that file decrypted. What they've demonstrated is a method that should work on Bezos' phone. Edit: OK, I see that they get the encrypted file from the WhatsApp server: > mediaurl = https://mmg-fna.whatsapp.net/d/f/[string].enc https://mmg-fna.whatsapp.net/d/f/[string].enc So might the Saudi file in question have been deleted from WhatsApp? Could the Saudis have done that?

ealexhudson 7y ago
WhatsApp themselves may have deleted it, who knows. I guess the point is, they claim to have the file, but haven't attempted to analyse it. I don't think anyone was claiming it wasn't video - it plays in the app, so clearly the majority of the data is indeed regular MPEG. And it's difficult to prove that an exploit _isn't_ present, especially if the payload could be hidden in the video stream (since you could control the video frames, you can likely hide a significant amount of data before you need to resort to actual steganography). But, given the claim (that a remote exploit was used to gain C&C over the phone), there must be _something_ odd in there: metadata that doesn't make sense, frames of video not used, etc. - because there's an overflow (which probably means some byte index or something in the metadata is bad) and an exploit (there's a payload in there making use of the overflow). At the very least, some regular software like ffmpeg will complain during decoding that stuff doesn't make sense.

4 ms·

No, they couldn't decrypt the file on Bezos' phone. Because they don't have the phone, or even the file. TFA actually says that clearly: > Remember that this

by mirimir 7y ago

ealexhudson 7y ago
WhatsApp themselves may have deleted it, who knows. I guess the point is, they claim to have the file, but haven't attempted to analyse it. I don't think anyone was claiming it wasn't video - it plays in the app, so clearly the majority of the data is indeed regular MPEG. And it's difficult to prove that an exploit _isn't_ present, especially if the payload could be hidden in the video stream (since you could control the video frames, you can likely hide a significant amount of data before you need to resort to actual steganography). But, given the claim (that a remote exploit was used to gain C&C over the phone), there must be _something_ odd in there: metadata that doesn't make sense, frames of video not used, etc. - because there's an overflow (which probably means some byte index or something in the metadata is bad) and an exploit (there's a payload in there making use of the overflow). At the very least, some regular software like ffmpeg will complain during decoding that stuff doesn't make sense.