Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WhatsApp Blocking Encrypted Calls to All Saudi Numbers

gist.github.com

Post reply on HN
Print view View original

31–40 of 86 posts

Re: WhatsApp Blocking Encrypted Calls to All Saudi Numbers

#31

Post by eridius »

subliminalpanda wrote: post #27
iamdave wrote: post #20

Earlier quoted context omitted.

To localize this behavior to the US as an example, Verizon wireless is known to block SIP traffic coming and going out of port 5060; it's entirely possible the Saudis are engaging this very similarly and have effectively blocked traffic, encrypted or not coming and going to a specific protocol port. So I don't think saying "there's no way to tell" is entirely accurate

I believe you would be correct in your assumption. I asked one of the engineers how they did it and that's what they told me to much chagrin.

Seems like WhatsApp could easily choose to use a different port if they wanted to, but I guess this comes back to not wanting to have their encrypted messages get blocked.

Re: WhatsApp Blocking Encrypted Calls to All Saudi Numbers

#32

Post by eridius »

DominikR wrote: post #23
eridius wrote: post #14

Earlier quoted context omitted.

The gist explicitly claims that's not possible. Specifically, it claims that there's no way for the Saudi teleco to distinguish encrypted phone calls from encrypted messages, and since you can send encrypted messages to Saudi users, there's no technical reason why you can't also call them. The implication is that if WhatsApp did allow the calls, the Saudi telecos might block both calls and messages (since they can't…

You can definitely distinguish with near 100% reliability if someone is messaging or calling, even if there is encryption involved. All you need to do is profile for relatively constant data transfer rates over the course of many minutes that exceed a very low minimum. If Whatsapp uses a media proxy for calls then you could just trigger on connections made to these servers where these data transfers in question occur…

Detecting calls like that would be for detecting calls in-progress, not for shutting them down during the initial handshake, which is what the gist claims is WhatsApp's explanation.

Re: WhatsApp Blocking Encrypted Calls to All Saudi Numbers

#33

Post by Al_Jazari »

"However the only true solution that respects the human rights of Saudi users is to give them encrypted calls no matter the consequences, instead of downgrading them to using regular Saudi phone lines, which are tapped by a religious dictatorship."

The British-found US-supported Saudi state and its regime is not a religious dictatorship. Geoff Simons described it best, IMHO, when he came up with title "Saudi Arabia: The Shape of a Client Feudalism" for his book.

On an even fussier note, some people in the Arabian peninsula don't recognize the legitimacy of the state/regime. And they really hate it when they are referred to as Saudis. It's like calling Widerstand Germans Hitlerians.

Re: WhatsApp Blocking Encrypted Calls to All Saudi Numbers

#34

Post by ultramancool »

eridius wrote: post #31
subliminalpanda wrote: post #27

Earlier quoted context omitted.

I believe you would be correct in your assumption. I asked one of the engineers how they did it and that's what they told me to much chagrin.

Seems like WhatsApp could easily choose to use a different port if they wanted to, but I guess this comes back to not wanting to have their encrypted messages get blocked.

Yeah, if they push back too much the Saudis would most likely just outright ban the entire service.

Re: WhatsApp Blocking Encrypted Calls to All Saudi Numbers

#35

Post by fenesiistvan »

captainmuon wrote: post #24
united893 wrote: post #3

They're simply providing a better user experience. The Saudis blocked encrypted calls, and users would have wait staring at frustrating repeated timeouts and long 'connecting' hangs. Therefore Whatsapp simply said OK, let's just improve the users experience by giving them an immediate error informing them.

Couldn't someone with WhatsApp/Facebook's resources find a way around the blockage? Write a bunch of different protocols and switch randomly - or use steganography - use machine learning to evade the block - buy a bunch of existing apps and hide the data in their protocols - put up a fake weak encryption, detect "dissident" talk, and in that case generate a long nonsense recording for the censors from the voices of t…

There are already software specialized for this such as the mizu VoIP tunneling and encryption which works with the SIP/RTP protocols: https://www.mizu-voip.com/Software/VoIPTunnel.aspx

Re: WhatsApp Blocking Encrypted Calls to All Saudi Numbers

#36

Post by dogma1138 »

eridius wrote: post #14
united893 wrote: post #3

They're simply providing a better user experience. The Saudis blocked encrypted calls, and users would have wait staring at frustrating repeated timeouts and long 'connecting' hangs. Therefore Whatsapp simply said OK, let's just improve the users experience by giving them an immediate error informing them.

The gist explicitly claims that's not possible. Specifically, it claims that there's no way for the Saudi teleco to distinguish encrypted phone calls from encrypted messages, and since you can send encrypted messages to Saudi users, there's no technical reason why you can't also call them. The implication is that if WhatsApp did allow the calls, the Saudi telecos might block both calls and messages (since they can't…

There are plenty of DPI/TM solutions that identify and classify the protocol very quickly and efficiently, every ISP today does it. It's highly unlikely that a Saudi or any modern telco would would not be able to analyse the traffic and extrapolate the exact protocol and application from it as well as other information such as if it's an encrypted stream or not (heck testing if data is encrypted or not is as simple as running compression on random samples and checking the compression ratio, you'll have to classify if the data is compressed to begin with but if it's not compressed data and it's not compressible it's quite likely to encrypted).

Re: WhatsApp Blocking Encrypted Calls to All Saudi Numbers

#37

Post by Retric »

eridius wrote: post #28
Retric wrote: post #15

Earlier quoted context omitted.

Bandwidth is going to be a major tell even if you have zero clue about content.

Bandwidth won't be apparent during the handshake. And voice data isn't really that large anyway, though it would be plausible to detect that some kind of stream is going on as opposed to discrete messages. Still, that would have to come mid-call rather than when the call is attempted.

Sure, in this case it's based on what port they are using. But, it's not a winnable problem due to bandwidth and the option to simply block everything. Limit encrypted streams to 3kbps and you can do eCommerce or slowly send a selfie not real time audio.

Re: WhatsApp Blocking Encrypted Calls to All Saudi Numbers

#38

Post by Canada »

eridius wrote: post #14
united893 wrote: post #3

They're simply providing a better user experience. The Saudis blocked encrypted calls, and users would have wait staring at frustrating repeated timeouts and long 'connecting' hangs. Therefore Whatsapp simply said OK, let's just improve the users experience by giving them an immediate error informing them.

The gist explicitly claims that's not possible. Specifically, it claims that there's no way for the Saudi teleco to distinguish encrypted phone calls from encrypted messages, and since you can send encrypted messages to Saudi users, there's no technical reason why you can't also call them. The implication is that if WhatsApp did allow the calls, the Saudi telecos might block both calls and messages (since they can't…

Assuming WhatsApp uses ZRTP, it's possible to detect and block encrypted calls no matter what port is used because the ZRTP advertisement can be seen in the RTP packet.

In order to know when ZRTP will fail WhatsApp would need to maintain lists of address space where ISPs drop such packets. It would have to be done on the client side, but then clients can't easily discover their public address because NAT. The signaling server that sets up the call could check easily, but if the server decided when not to use encryption that would be a backdoor.

It's easier to just do it by country code, despite the drawbacks.

Re: WhatsApp Blocking Encrypted Calls to All Saudi Numbers

#39

Post by DominikR »

eridius wrote: post #32
DominikR wrote: post #23

Earlier quoted context omitted.

You can definitely distinguish with near 100% reliability if someone is messaging or calling, even if there is encryption involved. All you need to do is profile for relatively constant data transfer rates over the course of many minutes that exceed a very low minimum. If Whatsapp uses a media proxy for calls then you could just trigger on connections made to these servers where these data transfers in question occur…

Detecting calls like that would be for detecting calls in-progress, not for shutting them down during the initial handshake, which is what the gist claims is WhatsApp's explanation.

My point was that this is one way to detect the IP where the client connects to for calls as call signalling, call media transfer and chat messaging all connect to different IP's.

Once you have that you can block media transfer, or if the clients use peer to peer media transfer at least block the call signalling.

After this it is only a matter of keeping the list of IP's updated which you could easily do by ongoing logging of bandwidth used.

Bandwidth usage pops up in your logs that somehow resembles the profile of a call - investigate by doing a simple test and then block the IP.

Re: WhatsApp Blocking Encrypted Calls to All Saudi Numbers

#40

Post by eridius »

Canada wrote: post #38
eridius wrote: post #14

Earlier quoted context omitted.

The gist explicitly claims that's not possible. Specifically, it claims that there's no way for the Saudi teleco to distinguish encrypted phone calls from encrypted messages, and since you can send encrypted messages to Saudi users, there's no technical reason why you can't also call them. The implication is that if WhatsApp did allow the calls, the Saudi telecos might block both calls and messages (since they can't…

Assuming WhatsApp uses ZRTP, it's possible to detect and block encrypted calls no matter what port is used because the ZRTP advertisement can be seen in the RTP packet. In order to know when ZRTP will fail WhatsApp would need to maintain lists of address space where ISPs drop such packets. It would have to be done on the client side, but then clients can't easily discover their public address because NAT. The signali…

According to Wikipedia, ZRTP use a specific encryption protocol (SRTP). Surely that means that calls made using Signal can't be using ZRTP.
Post reply on HN