3 ms·

It's so easy to get the password. Anyone with you on the same WIFI can get your WIFI Mac address about passwords: https://plus.google.com/109599361571767865655/

by wajdis 14y ago

It's so easy to get the password. Anyone with you on the same WIFI can get your WIFI Mac address about passwords: https://plus.google.com/109599361571767865655/posts/5ijzy29iaNn https://plus.google.com/109599361571767865655/posts/5ijzy29i...

damian2000 14y ago
Might be a good idea to publish the source to your tool in a gist or something along with this explanation... First impression for most users would be that this is credential harvesting webpage with who knows what running behind it.
- wajdis 14y ago
  The page has been updated, and the source code is here: https://github.com/whatsapp/WhatsAPI/ https://github.com/whatsapp/WhatsAPI/
  - Cyril-Boh 14y ago
    Tried using this source. Can't seem to get the number and MAC combination right. Using my own phone and account BTW.
    - wajdis 14y ago
      What's ur device ? (Android or iOS ?)
      - tejasm 14y ago
        edit Worked for my android. Still not working for iOS.
      - Cyril-Boh 14y ago
        iOS I was using \test\whatsapp.php.
  - dutchbrit 14y ago
    Based off https://github.com/venomous0x/WhatsAPI https://github.com/venomous0x/WhatsAPI Have you played with the node.js clients?
vowelless 14y ago
But it isn't easy to get the IMEI #. In my opinion, it does provide some sort of security.
- DrJokepu 14y ago
  It's trivial to get these values from software and it is (was) a very common practice amongst app developers, advertisers etc. to collect this information and store it in a database. I can guarantee you that the IMEI in the majority of these databases is stored as plaintext. Due to the easy access to these numbers as well as the large number of massive existing databases of them, IMEI numbers are simply not suitable password equivalents in any way and merely suggesting the contrary makes our world a less secure place.
- wajdis 14y ago
  The IMEI is harder, but any one who can grap your phone can enter *#06# to get your IMEI. Also, it's available on the box of your device, and many apps store the IMEI to identify your device.
taylorbuley 14y ago
FTP. AIM. These are equally if not more insecure for the same reasons. Not to mention that if you're on my network a "Whatapp" account is the least of my concerns.
- chimeracoder 14y ago
  > Not to mention that if you're on my network a "Whatapp" account is the least of my concerns. How about if you're on someone else's network (work, a friend's, an airport, etc...)
- mirashii 14y ago
  No, they're not. 1) Your mac address is available to even passive sniffers without the key to an encrypted network. In some circumstances you don't even need to be connected to a network to grab someone's mac address (iPhones in particular love looking for networks loudly). 2) FTP and AIM passwords can be changed. Yes, a passive sniffer on the same network can still get them, but this is a significantly harder task than getting someone's mac address, and there's no way to change the goal. 3) Brute force attacks become within the realm of possibility. Have someone you know has an iPhone 5 and uses WhatsApp? The first chunk of the mac address is assigned by vendor, so you've already narrowed the search space down drastically by half to needing to guess 6 hex digits.

by wajdis 14y ago

damian2000 14y ago

Might be a good idea to publish the source to your tool in a gist or something along with this explanation... First impression for most users would be that this is credential harvesting webpage with who knows what running behind it.

wajdis 14y ago
The page has been updated, and the source code is here: https://github.com/whatsapp/WhatsAPI/ https://github.com/whatsapp/WhatsAPI/
- Cyril-Boh 14y ago
  Tried using this source. Can't seem to get the number and MAC combination right. Using my own phone and account BTW.
  - wajdis 14y ago
    What's ur device ? (Android or iOS ?)
    - tejasm 14y ago
      edit Worked for my android. Still not working for iOS.
    - Cyril-Boh 14y ago
      iOS I was using \test\whatsapp.php.
- dutchbrit 14y ago
  Based off https://github.com/venomous0x/WhatsAPI https://github.com/venomous0x/WhatsAPI Have you played with the node.js clients?

vowelless 14y ago

But it isn't easy to get the IMEI #. In my opinion, it does provide some sort of security.

DrJokepu 14y ago
It's trivial to get these values from software and it is (was) a very common practice amongst app developers, advertisers etc. to collect this information and store it in a database. I can guarantee you that the IMEI in the majority of these databases is stored as plaintext. Due to the easy access to these numbers as well as the large number of massive existing databases of them, IMEI numbers are simply not suitable password equivalents in any way and merely suggesting the contrary makes our world a less secure place.
wajdis 14y ago
The IMEI is harder, but any one who can grap your phone can enter *#06# to get your IMEI. Also, it's available on the box of your device, and many apps store the IMEI to identify your device.

taylorbuley 14y ago

FTP. AIM. These are equally if not more insecure for the same reasons. Not to mention that if you're on my network a "Whatapp" account is the least of my concerns.

chimeracoder 14y ago
> Not to mention that if you're on my network a "Whatapp" account is the least of my concerns. How about if you're on someone else's network (work, a friend's, an airport, etc...)
mirashii 14y ago
No, they're not. 1) Your mac address is available to even passive sniffers without the key to an encrypted network. In some circumstances you don't even need to be connected to a network to grab someone's mac address (iPhones in particular love looking for networks loudly). 2) FTP and AIM passwords can be changed. Yes, a passive sniffer on the same network can still get them, but this is a significantly harder task than getting someone's mac address, and there's no way to change the goal. 3) Brute force attacks become within the realm of possibility. Have someone you know has an iPhone 5 and uses WhatsApp? The first chunk of the mac address is assigned by vendor, so you've already narrowed the search space down drastically by half to needing to guess 6 hex digits.