5 ms·
If this was happening en-masse, wouldn't this be discovered by the many people reverse engineering WhatsApp? Reverse engineering is hard sophisticated work, but
by varenc 9mo ago
If this was happening en-masse, wouldn't this be discovered by the many people reverse engineering WhatsApp? Reverse engineering is hard sophisticated work, but given how popular WhatsApp is plenty of independent security researchers are doing it. I'm quite skeptical Meta could hide some malicious code in WhatsApp that's breaking the E2EE without it being discovered.
- beagle3 9mo agoThis was happening en masse, perhaps still does - the cloud backup was unencrypted. Originally it was encrypted. Then, one day, Google stopped counting it towards your storage quota, but it became unencrypted. But even before that, Meta had the encryption keys (and probably still does). When you get a new phone, all you need is your phone number to retrieve the past chats from backup; nothing else. That proves, regardless of specifics, that Meta can read your chats - they can send it to any new phone. So it doesn’t really matter that it is E2EE in transit - they just have to wait for the daily backup, and they can read it then.
- palata 9mo agoBefore that, Meta employees would know about it. Pretty convinced that someone would leak it.
- cosmicgadget 9mo agoWell they wouldn't be breaking e2ee, they'd be breaking the implicit promise of e2ee. The chats are still inaccessible to intermediaries, they'd just be stored elsewhere. Like Apple and Microsoft do. I am not familiar with the state of app RE. But between code obfuscators and the difficulty of distinguishing between 'normal' phone home data and user chats when doing static analysis... I'd say it's not out of the question.
- solenoid0937 9mo agoIt would be trivial to discover and would be pretty big news in the security community. I'd wager most of these comments are from nontechnical people, or technical people that are very far removed from security.
- cosmicgadget 9mo agoI'm technical and work in security. Since it is trivial, please explain. Ideally not using a strawman like "well just run strings and look for uploadPlaintextChatsToServer()".
- solenoid0937 9mo agoI don't see why standard RE techniques (DBI/Frida + MITM) wouldn't work, do you? WhatsApp is constantly RE'd because it'd be incredibly valuable to discover gaps in its security posture, the community would find any exfil here.
- martinralbrecht 9mo agoWe did reverse engineer it and we're cryptographers not reverse engineering experts https://eprint.iacr.org/2025/794 https://eprint.iacr.org/2025/794
- deleted 9mo ago[deleted]
- solenoid0937 9mo agoCool paper, thanks for sharing!
- cosmicgadget 9mo agoIf people are trivially hooking IOS and Android applications then sure, it's just an exercise in dynamic analysis. Mobile applications are outside my domain so I am surprised platform security (SEL, attestation, etc.) has been so easily defeated.