4 ms·
But how would the attacker get the generated image on a person's phone?
by magpi3 5y ago
But how would the attacker get the generated image on a person's phone?
- Koffiepoeder 5y agoE.g. send them a whatsapp message that looks innocent
- endisneigh 5y agoThey can see the image - why would they import a random image into their library from someone they don’t know?
- markus92 5y agoAuto import could be turned on?
- kemayo 5y agoWhatsApp has a really weird default behavior: it imports all images you're sent into your photo library. This is a smart thing to disable, even outside this recent discussion of CSAM. https://faq.whatsapp.com/android/how-to-stop-saving-whatsapp-media-to-your-phones-gallery/?lang=en https://faq.whatsapp.com/android/how-to-stop-saving-whatsapp...
- endisneigh 5y agoIn that scenario this attack is unnecessary. Someone could just send you legitimate child pornography and then immediately tell the authorities that you possess said things.
- kemayo 5y agoYup! It's a legitimately crazy default. Edit: Though, to be fair, the specific hash-collision scenario would be that someone could send you something that doesn't look like CSAM and so you wouldn't reflexively delete it.
- endisneigh 5y agoIf it doesn’t look like it wouldn’t a human reviewer disregard it once it gets to that point? Personally I don’t really see the issue.
- kemayo 5y agoYeah, you'd need a very specific set of processes for it to really be a problem.
- MisterSandman 5y agoWe don't know how the human review is going to work. Countries with fewer resources are going to find it easier to just arrest/detain any suspects, instead of spending time and money on figuring out which reports are true. All you have to be is accused of CP for your life to be destroyed. It doesn't matter if you did it or not.
- endisneigh 5y agoWhat you’re describing is possible even if you didn’t receive anything. If the government wants to get you they don’t need this Apple scanning tech, or anything at all really
- Kliment 5y agoWhatsapp imports received images into camera roll by default, and icloud sync is on by default. So you just need to get into a WA group the victim is a member of, and have the victim use default settings.
- bo1024 5y agoI didn't mean to suggest a targeted attack. If the goal is to just overwhelm Apple's system, the attacker doesn't need to target a particular phone, they just need to distribute lots of colliding images to some phones. Even their own phones, since the colliding images wouldn't be illegal.
- bumblebritches5 5y agoSeriously? Look into Pegasus and Candiru