6 ms·

Yeah, no end-to-end encryption and all that. But how many 0-days have been discovered in MMS? WhatsApp is starting to look like a TLA backdoor in comparison.

by zibzab 5y ago

AniseAbyss 5y ago
Easier for government to infiltrate a local mobile operator than getting into WhatsApp/Telegram/Signal etc. The revolution will be WhatsApped.
- uf00lme 5y ago
  It might be easier for local government to control telcos but much more difficult for a foreign government when compared to what might be a secret court warrant etc.
  - AniseAbyss 5y ago
    If your opponent is the US government you are already doomed.
ChuckNorris89 5y ago
>But how many 0-days have been discovered in MMS? WhatsApp is starting to look like a TLA backdoor in comparison. Your comparison doesn't make sense. MMS has no need for 0-days as it's a basic communication protocol that has zero security to begin with. That's like saying "but how many 0-days does TCP-IP have?"
- zibzab 5y ago
  Zero security in what sense? Is confidentiality of your messages the only thing you care about? Even that you won't get to keep once hit by a WhatsApp vulnerability.
  - ChuckNorris89 5y ago
    >once hit by a WhatsApp vulnerability Meh, and once you get hit by a car, you will die. But what are the realistic odds of that happening? You can also get hit by a an IOS or Android RCE 0-day, so you might as well give up using a smartphone if you feel the security risk is that high. Also, many of those RCE exploits used MMS for payload delivery, so your point of MMS shielding you from exploits is moot. In the end, for most consumers, it's a matter of looking at the convenience to risk ratio, and MMS is neither very convenient nor terribly secure.
    - hulitu 5y ago
      > In the end, for most consumers, it's a matter of looking at the convenience to risk ratio, and MMS is neither very convenient nor terribly secure. Well, most consumers do not accept the same argument for http vs https.
      - ChuckNorris89 5y ago
        Ok, but what does that have to do with it? I never made any arguments on http vs https, so why are you going off topic? Consumers don't have any tradeoffs on https vs insecure http so this comparison is not even in the same ballpark.
    - zibzab 5y ago
      Dude, you are completely missing the point. All I am saying is that replacing a simple and well tested system with a complex and barely evaluated system is bad for security. And for the record, ALMOST ALL recent high profile hacks were related to WhatsApp.
      - ChuckNorris89 5y ago
        >All I am saying is that replacing a simple and well tested system with a complex and barely evaluated system is bad for security. 1) Nobody is replacing MMS with WhatApp for you, you are free to use whatever alternative fits your needs best. 2) A system which almost nobody used because it was expensive to use in the beginning, insecure by today's standards, and doesn't serve the present day needs of consumers making it severely outdated, which is why phone users migrated in droves to alternatives like WhatsApp many years ago. If carriers and the 3GPP consortium wanted to keep MMS relevant, then they should have updated it to support encryption and higher definition multi-media, and carriers shouldn't have charged through the nose for the service, but the SW industry disrupted the telecom industry with much higher quality messaging apps that were also free, which deprecated carriers to be just dumb data pipes and made SMS/MMS mostly obsolete. >And for the record, ALMOST ALL recent high profile hacks were related to WhatsApp. That's needlessly exaggerating without posting any sources for such grave claims. Which "recent high profile whatsapp hacks"?
mjg59 5y ago
MMS is a vehicle into your phone's media decoding stack, and there have definitely been vulnerabilities demonstrated using MMS as the delivery mechanism (eg,https://googleprojectzero.blogspot.com/2020/07/mms-exploit-part-1-introduction-to-qmage.html?m=1 https://googleprojectzero.blogspot.com/2020/07/mms-exploit-p...)
advisedwang 5y ago
At least one: https://www.theregister.com/2020/05/08/samsung_android_patches/ https://www.theregister.com/2020/05/08/samsung_android_patch... (https://bugs.chromium.org/p/project-zero/issues/detail?id=2002 https://bugs.chromium.org/p/project-zero/issues/detail?id=20...)

Yeah, no end-to-end encryption and all that. But how many 0-days have been discovered in MMS? WhatsApp is starting to look like a TLA backdoor in comparison.

by zibzab 5y ago

Yeah, no end-to-end encryption and all that. But how many 0-days have been discovered in MMS? WhatsApp is starting to look like a TLA backdoor in comparison.

AniseAbyss 5y ago

Easier for government to infiltrate a local mobile operator than getting into WhatsApp/Telegram/Signal etc. The revolution will be WhatsApped.

uf00lme 5y ago
It might be easier for local government to control telcos but much more difficult for a foreign government when compared to what might be a secret court warrant etc.
- AniseAbyss 5y ago
  If your opponent is the US government you are already doomed.

ChuckNorris89 5y ago

>But how many 0-days have been discovered in MMS? WhatsApp is starting to look like a TLA backdoor in comparison. Your comparison doesn't make sense. MMS has no need for 0-days as it's a basic communication protocol that has zero security to begin with. That's like saying "but how many 0-days does TCP-IP have?"

zibzab 5y ago
Zero security in what sense? Is confidentiality of your messages the only thing you care about? Even that you won't get to keep once hit by a WhatsApp vulnerability.
- ChuckNorris89 5y ago
  >once hit by a WhatsApp vulnerability Meh, and once you get hit by a car, you will die. But what are the realistic odds of that happening? You can also get hit by a an IOS or Android RCE 0-day, so you might as well give up using a smartphone if you feel the security risk is that high. Also, many of those RCE exploits used MMS for payload delivery, so your point of MMS shielding you from exploits is moot. In the end, for most consumers, it's a matter of looking at the convenience to risk ratio, and MMS is neither very convenient nor terribly secure.
  - hulitu 5y ago
    > In the end, for most consumers, it's a matter of looking at the convenience to risk ratio, and MMS is neither very convenient nor terribly secure. Well, most consumers do not accept the same argument for http vs https.
    - ChuckNorris89 5y ago
      Ok, but what does that have to do with it? I never made any arguments on http vs https, so why are you going off topic? Consumers don't have any tradeoffs on https vs insecure http so this comparison is not even in the same ballpark.
  - zibzab 5y ago
    Dude, you are completely missing the point. All I am saying is that replacing a simple and well tested system with a complex and barely evaluated system is bad for security. And for the record, ALMOST ALL recent high profile hacks were related to WhatsApp.
    - ChuckNorris89 5y ago
      >All I am saying is that replacing a simple and well tested system with a complex and barely evaluated system is bad for security. 1) Nobody is replacing MMS with WhatApp for you, you are free to use whatever alternative fits your needs best. 2) A system which almost nobody used because it was expensive to use in the beginning, insecure by today's standards, and doesn't serve the present day needs of consumers making it severely outdated, which is why phone users migrated in droves to alternatives like WhatsApp many years ago. If carriers and the 3GPP consortium wanted to keep MMS relevant, then they should have updated it to support encryption and higher definition multi-media, and carriers shouldn't have charged through the nose for the service, but the SW industry disrupted the telecom industry with much higher quality messaging apps that were also free, which deprecated carriers to be just dumb data pipes and made SMS/MMS mostly obsolete. >And for the record, ALMOST ALL recent high profile hacks were related to WhatsApp. That's needlessly exaggerating without posting any sources for such grave claims. Which "recent high profile whatsapp hacks"?

mjg59 5y ago

MMS is a vehicle into your phone's media decoding stack, and there have definitely been vulnerabilities demonstrated using MMS as the delivery mechanism (eg,https://googleprojectzero.blogspot.com/2020/07/mms-exploit-part-1-introduction-to-qmage.html?m=1 https://googleprojectzero.blogspot.com/2020/07/mms-exploit-p...)

advisedwang 5y ago

At least one: https://www.theregister.com/2020/05/08/samsung_android_patches/ https://www.theregister.com/2020/05/08/samsung_android_patch... (https://bugs.chromium.org/p/project-zero/issues/detail?id=2002 https://bugs.chromium.org/p/project-zero/issues/detail?id=20...)