5 ms·

The article (the readme on github) takes the following quote wildly out of context: > A recent high-profile forensic investigation reported that “due to end-to

by natch 7y ago

The article (the readme on github) takes the following quote wildly out of context: > A recent high-profile forensic investigation reported that “due to end-to-end encryption employed by WhatsApp, it is virtually impossible to decrypt the contents of the downloader [.enc file] This quote clearly means it is virtually impossible without the key. OF COURSE if you have full access to the device as a logged in user, then you can get access to the key and decrypt things that cannot be decrypted by others who do not have the key. Nothing to see here. At least to the author’s credit the FAQ answers below clarify this, but not after the lead in, which is all most people read, has already done the damage of dramatically planting the incorrect impression that someone has figured out how to break WhatsApp encryption.

dinodaizovi 7y ago
Hello! I'm the author of this tool. That quote is from the data forensics report on Bezos' phone, so the missing context was them stating that even with a full logical file data acquisition, they couldn't decrypt the .enc file. That is what inspired me to write this tool to demonstrate how end-to-end encryption is only impossible to decrypt by intermediate hosts, it's very possible with full access to the filesystem of one of the endpoints. I could likely make that part of the README clearer by adding more context from the original forensics report that was published. Thanks! -Dino
varispeed 7y ago
I think the "end-to-end" statement is also misleading as you don't really know whether the communication is indeed encrypted end to end. If you want true end to end ecryption you can grab a tool that will generate public and private key pair, send public key to your contact and ask them for their public key. Then use tool to encrypt your following messages with your private key and received messages with your contact's public key. Then it doesn't matter whether underlying transport is encrypted or not. Things like Whatsapp give false sense of security. I am pretty sure the messaging can be accessed but nobody will ever admit it. You can make it less obvious that you are sending encrypted messages by using two way binary to English text transcoder, so your messages will appear like an English conversation (although easy to pick as gibberish by a censor)
- maxerickson 7y ago
  It's entirely possible to examine the compiled app and understand whether it sends the private key or unencrypted messages off the device, there's no need to treat the behavior or Whatsapp like a mystery.
  - dependenttypes 7y ago
    It is not as simple.
  - upofadown 7y ago
    It is possible but extremely unlikely that anyone would ever bother to do this. Anyone that cared that much would just use something with source available and save themselves a whole lot of pointless effort that would have to be repeated every time a new binary was generated.
  - varispeed 7y ago
    You don't know whether private key is generated in a way that could be replicated on the server and you don't know what is running on the other side.
  - rndgermandude 7y ago
    The crux of the matter is verifying that the public key you're told is the public key of the other person, is actually the public key of the other person. If you do not verify this out-of-band, then the server can generate a new keypair for each recipient and it would go like this: - Alice encrypts message using FAKE public key of Bob (she was told is Bob's key by the server), sends it to whatseverapp server so it can be delivered to Bob when he sign on. - Whatseverapp server has FAKE private key for Bob (it generated that one itself, after all), decrypts message and notifies the corporate overlords/government/Russians/AdSevers/Illuminati of contents. - Whatseverapp server encrypt message using REAL public key of Bob, sends it to Bob - Bob decrypts the message using his REAL public key, reads it. This out-of-ban verification is nothing you can automate or do once-for-all, like analyzing the binary for bad stuff. Each user has to verify the key of the other users. Which very few people actually do. Also, you make it sound so easy to analyze an app binary. You can relatively easily prove it does certain things; but to prove a negative, namely that it does NOT do certain things is far more difficult at least and outright infeasible or even impossible in other cases (compare with halting problem). This is why security vulnerabilities happen, and a backdoor is more or less just a security vulnerability that didn't happen by accident or incompetence but deliberately - which may mean whoever put it there might have spent some time to obfuscate it even further to make it harder to find.
marcan_42 7y ago
If you read the referenced forensic investigation, you'll note the obvious incompetence of the forensic investigator involved. The whole thing is a clueless "I ran some forensics tools" job. This tool is a response to that - that that statement by the forensic investigator is nonsense, because if you have full access to the device (as they did), you can easily extract the decryption key for media files present on the device. The quote isn't out of context, the quote is just nonsense and wrong. They had the key.

by natch 7y ago

dinodaizovi 7y ago

Hello! I'm the author of this tool. That quote is from the data forensics report on Bezos' phone, so the missing context was them stating that even with a full logical file data acquisition, they couldn't decrypt the .enc file. That is what inspired me to write this tool to demonstrate how end-to-end encryption is only impossible to decrypt by intermediate hosts, it's very possible with full access to the filesystem of one of the endpoints. I could likely make that part of the README clearer by adding more context from the original forensics report that was published. Thanks! -Dino

varispeed 7y ago

I think the "end-to-end" statement is also misleading as you don't really know whether the communication is indeed encrypted end to end. If you want true end to end ecryption you can grab a tool that will generate public and private key pair, send public key to your contact and ask them for their public key. Then use tool to encrypt your following messages with your private key and received messages with your contact's public key. Then it doesn't matter whether underlying transport is encrypted or not. Things like Whatsapp give false sense of security. I am pretty sure the messaging can be accessed but nobody will ever admit it. You can make it less obvious that you are sending encrypted messages by using two way binary to English text transcoder, so your messages will appear like an English conversation (although easy to pick as gibberish by a censor)

maxerickson 7y ago
It's entirely possible to examine the compiled app and understand whether it sends the private key or unencrypted messages off the device, there's no need to treat the behavior or Whatsapp like a mystery.
- dependenttypes 7y ago
  It is not as simple.
- upofadown 7y ago
  It is possible but extremely unlikely that anyone would ever bother to do this. Anyone that cared that much would just use something with source available and save themselves a whole lot of pointless effort that would have to be repeated every time a new binary was generated.
- varispeed 7y ago
  You don't know whether private key is generated in a way that could be replicated on the server and you don't know what is running on the other side.
- rndgermandude 7y ago
  The crux of the matter is verifying that the public key you're told is the public key of the other person, is actually the public key of the other person. If you do not verify this out-of-band, then the server can generate a new keypair for each recipient and it would go like this: - Alice encrypts message using FAKE public key of Bob (she was told is Bob's key by the server), sends it to whatseverapp server so it can be delivered to Bob when he sign on. - Whatseverapp server has FAKE private key for Bob (it generated that one itself, after all), decrypts message and notifies the corporate overlords/government/Russians/AdSevers/Illuminati of contents. - Whatseverapp server encrypt message using REAL public key of Bob, sends it to Bob - Bob decrypts the message using his REAL public key, reads it. This out-of-ban verification is nothing you can automate or do once-for-all, like analyzing the binary for bad stuff. Each user has to verify the key of the other users. Which very few people actually do. Also, you make it sound so easy to analyze an app binary. You can relatively easily prove it does certain things; but to prove a negative, namely that it does NOT do certain things is far more difficult at least and outright infeasible or even impossible in other cases (compare with halting problem). This is why security vulnerabilities happen, and a backdoor is more or less just a security vulnerability that didn't happen by accident or incompetence but deliberately - which may mean whoever put it there might have spent some time to obfuscate it even further to make it harder to find.

marcan_42 7y ago

If you read the referenced forensic investigation, you'll note the obvious incompetence of the forensic investigator involved. The whole thing is a clueless "I ran some forensics tools" job. This tool is a response to that - that that statement by the forensic investigator is nonsense, because if you have full access to the device (as they did), you can easily extract the decryption key for media files present on the device. The quote isn't out of context, the quote is just nonsense and wrong. They had the key.