3 ms·

I didn't quite understand how they are capable of tracking people and breaking WhatsApp encryption. There is mention of fake antenna but I don't think they cov

I didn't quite understand how they are capable of tracking people and breaking WhatsApp encryption. There is mention of fake antenna but I don't think they cover entire country with that, how do they do?

jonplackett 1y ago
Yes - and they also claim not to track users themselves. Is that just a lie or is there someone else doing the tracking? This article answers none of my questions!
- kipchak 1y ago
  There's more details in the technical explainer linked in the article. https://www.lighthousereports.com/methodology/surveillance-secrets-explainer/ https://www.lighthousereports.com/methodology/surveillance-s...
CGMthrowaway 1y ago
They use vulns in the outdated SS7 system to trick networks into revealing a numbers location (1), and intercept SMS including the verification codes sent by apps like WhatsApp - allowing them to hijack accounts and monitor messages and calls directly (2). This method works remotely and doesn’t require antennas The SMS are intercepted because thru SS7 by tricking the network into thinking the target phone is roaming (3). (1)https://www.lighthousereports.com/methodology/surveillance-secrets-explainer/ https://www.lighthousereports.com/methodology/surveillance-s... (2)https://www.motherjones.com/politics/2025/10/firstwap-altamides-phone-tracking-surveillance-secrets-assad-erik-prince-jared-leto-anne-wojcicki/ https://www.motherjones.com/politics/2025/10/firstwap-altami... (3)https://www.fyno.io/blog/is-it-easy-to-intercept-sms-a-complete-guide-clzs7nipc00fb78t2fdebxdan https://www.fyno.io/blog/is-it-easy-to-intercept-sms-a-compl...
- arkadiyt 1y ago
  > intercept SMS including the verification codes sent by apps like WhatsApp For anyone worried, this approach: 1) Breaks the existing phone from receiving WhatsApp messages, so you can notice that behavior 2) Can be prevented by setting up a WhatsApp pin in your settings
  - simultsop 1y ago
    Probably these were addressed way too late. Developers are the last to know their backdoors surprisingly.
- citizenpaul 1y ago
  Not just vulns. It is possible to simply purchase access or become a provider in the SS7 system (<$20-50k USD). SMS is basically a completely open system at this point. Cybersecurity companies do it all the time for pentesting. So do "Cybersecurity companies". Horrifying that nearly banks still require you to use sms as a 2fa and do not offer any other alternative. Did you really think the US Gov was OK with facebook running the biggest "encrypted" SMS system on earth. LOL of course they already had access to all the messages.
  - varenc 1y ago
    Hijacking WhatsApp SMS authentication codes can be prevented by just adding a PIN to your account. Doing this attack also doesn't grant you access to someone's old WhatsApp messages, and contacts with "security notices" enabled will see that your device has changed. It's quite different than big gov just having access to all your WhatsApp messages. (But there might be other ways they can do this, but just SMS sniffing doesn't get you there)
  - bayindirh 1y ago
    > Horrifying that nearly banks still require you to use sms as a 2fa and do not offer any other alternative. In my country banking applications are tied to your phone via IMEI, SIM and other hardware dependent information available. Forget getting banking details and use another device without the user knowing, either. If someone clones your SIM or gets a replacement in behalf of you, your all banking access is blocked until you enable them one by one with your ID card or other means. One of the banks can use FaceID as a secondary factor, too. So, other methods are possible. It's an "implementation detail" at this point.

jonplackett 1y ago

Yes - and they also claim not to track users themselves. Is that just a lie or is there someone else doing the tracking? This article answers none of my questions!

kipchak 1y ago
There's more details in the technical explainer linked in the article. https://www.lighthousereports.com/methodology/surveillance-secrets-explainer/ https://www.lighthousereports.com/methodology/surveillance-s...

CGMthrowaway 1y ago

They use vulns in the outdated SS7 system to trick networks into revealing a numbers location (1), and intercept SMS including the verification codes sent by apps like WhatsApp - allowing them to hijack accounts and monitor messages and calls directly (2). This method works remotely and doesn’t require antennas The SMS are intercepted because thru SS7 by tricking the network into thinking the target phone is roaming (3). (1)https://www.lighthousereports.com/methodology/surveillance-secrets-explainer/ https://www.lighthousereports.com/methodology/surveillance-s... (2)https://www.motherjones.com/politics/2025/10/firstwap-altamides-phone-tracking-surveillance-secrets-assad-erik-prince-jared-leto-anne-wojcicki/ https://www.motherjones.com/politics/2025/10/firstwap-altami... (3)https://www.fyno.io/blog/is-it-easy-to-intercept-sms-a-complete-guide-clzs7nipc00fb78t2fdebxdan https://www.fyno.io/blog/is-it-easy-to-intercept-sms-a-compl...

arkadiyt 1y ago
> intercept SMS including the verification codes sent by apps like WhatsApp For anyone worried, this approach: 1) Breaks the existing phone from receiving WhatsApp messages, so you can notice that behavior 2) Can be prevented by setting up a WhatsApp pin in your settings
- simultsop 1y ago
  Probably these were addressed way too late. Developers are the last to know their backdoors surprisingly.
citizenpaul 1y ago
Not just vulns. It is possible to simply purchase access or become a provider in the SS7 system (<$20-50k USD). SMS is basically a completely open system at this point. Cybersecurity companies do it all the time for pentesting. So do "Cybersecurity companies". Horrifying that nearly banks still require you to use sms as a 2fa and do not offer any other alternative. Did you really think the US Gov was OK with facebook running the biggest "encrypted" SMS system on earth. LOL of course they already had access to all the messages.
- varenc 1y ago
  Hijacking WhatsApp SMS authentication codes can be prevented by just adding a PIN to your account. Doing this attack also doesn't grant you access to someone's old WhatsApp messages, and contacts with "security notices" enabled will see that your device has changed. It's quite different than big gov just having access to all your WhatsApp messages. (But there might be other ways they can do this, but just SMS sniffing doesn't get you there)
- bayindirh 1y ago
  > Horrifying that nearly banks still require you to use sms as a 2fa and do not offer any other alternative. In my country banking applications are tied to your phone via IMEI, SIM and other hardware dependent information available. Forget getting banking details and use another device without the user knowing, either. If someone clones your SIM or gets a replacement in behalf of you, your all banking access is blocked until you enable them one by one with your ID card or other means. One of the banks can use FaceID as a secondary factor, too. So, other methods are possible. It's an "implementation detail" at this point.