Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Attack of the Week: Group Messaging in WhatsApp and Signal

blog.cryptographyengineering.com

Post reply on HN
Print view View original

11–20 of 36 posts

Re: Attack of the Week: Group Messaging in WhatsApp and Signal

#11

Post by WildGreenLeave »

arkadiyt wrote: post #7
problems wrote: post #3

So they didn't bother to check if the add to group message was from someone in the group? I mean no offense to the developers, but this seems like a fairly basic oversight and quite concerning that respected and popular products didn't get this level of review until now. No crazy cryptographic mess involving improper ordering of authentication or weird random number generation, this is a simple logic bug. One that I'…

> One that I'm sure many of us would have considered if we were implementing it, things like this do get missed too of course, but enough eyes on the design could have caught this. It wasn't a design flaw, it was an insecure-direct-object-reference implementation flaw. IDORs are extremely common, but since the group id is an unguessable 128 bits, the bug can only be used by someone who was already in the group previo…

> The real harm comes from regular people reading articles like the Wired one or the famously wrong Guardian one and switching to much worse alternatives, like SMS or Telegram.

I can understand why you give SMS as an example, because it is just plaintext. But why Telegram? As far as I know Telegram is probably better secured over a service like Whatsapp.

Edit: the latter is an assumption from me, I do not have any claims to back this up. Thats why I'm asking.

Re: Attack of the Week: Group Messaging in WhatsApp and Signal

#12

Post by arkadiyt »

WildGreenLeave wrote: post #11
arkadiyt wrote: post #7

Earlier quoted context omitted.

> One that I'm sure many of us would have considered if we were implementing it, things like this do get missed too of course, but enough eyes on the design could have caught this. It wasn't a design flaw, it was an insecure-direct-object-reference implementation flaw. IDORs are extremely common, but since the group id is an unguessable 128 bits, the bug can only be used by someone who was already in the group previo…

> The real harm comes from regular people reading articles like the Wired one or the famously wrong Guardian one and switching to much worse alternatives, like SMS or Telegram. I can understand why you give SMS as an example, because it is just plaintext. But why Telegram? As far as I know Telegram is probably better secured over a service like Whatsapp. Edit: the latter is an assumption from me, I do not have any cl…

Telegram group messages are not end-to-end encrypted at all, the Telegram service has access to all message content.

Wish you weren't getting downvoted for asking this - asking is how people learn.

Re: Attack of the Week: Group Messaging in WhatsApp and Signal

#13

Post by whyever »

rickycook wrote: post #8
yuliyp wrote: post #6

Earlier quoted context omitted.

Hyperbolic much? This is a weakness that not only requires WhatsApp to be malicious but to not care about the trivial visibility of an exploit (the client would still display the extra person being added to the group chat).

not malicious per se, just with non obvious ulterior motives

They have a feature where you can invite people to the group with a link that requires the server being able to add people. Isn't that a fairly obvious motive?

Re: Attack of the Week: Group Messaging in WhatsApp and Signal

#14

Post by whyever »

WildGreenLeave wrote: post #11
arkadiyt wrote: post #7

Earlier quoted context omitted.

> One that I'm sure many of us would have considered if we were implementing it, things like this do get missed too of course, but enough eyes on the design could have caught this. It wasn't a design flaw, it was an insecure-direct-object-reference implementation flaw. IDORs are extremely common, but since the group id is an unguessable 128 bits, the bug can only be used by someone who was already in the group previo…

> The real harm comes from regular people reading articles like the Wired one or the famously wrong Guardian one and switching to much worse alternatives, like SMS or Telegram. I can understand why you give SMS as an example, because it is just plaintext. But why Telegram? As far as I know Telegram is probably better secured over a service like Whatsapp. Edit: the latter is an assumption from me, I do not have any cl…

Your assumption is wrong. I fear that articles like this are partially responsible for that.

Re: Attack of the Week: Group Messaging in WhatsApp and Signal

#15

Post by tinus_hn »

The attack is real but I’m not impressed by the way they paper over the notifications you’d get that they consider ‘easy to miss’. The messages you get when someone gets a new phone/key are even easier to miss and they’re off by default.

The point is that the server doesn’t know if they’re off and if you’re paying attention so if it’s cheating it runs the chance of being detected.

Re: Attack of the Week: Group Messaging in WhatsApp and Signal

#17

Post by bjoli »

jgunsch wrote: post #5

Does anyone know what the disclosure story is here? Have WhatsApp and Signal had a chance to respond?

I follow the development of signal quite a bit. Moxie comitted fixes about what he called "old sins" concerning group messaging.

This was quite some time ago, so they have been aware of that it was lacking somehow, possibly even before this was discovered.

Re: Attack of the Week: Group Messaging in WhatsApp and Signal

#18

Post by dx034 »

v1nc wrote: post #9
jgunsch wrote: post #5

Does anyone know what the disclosure story is here? Have WhatsApp and Signal had a chance to respond?

As said here: https://www.wired.com/story/whatsapp-security-flaws-encrypti... "The researchers say that Open Whisper Systems, the non-profit that runs and maintains Signal, nonetheless responded to their work, saying that it's currently redesigning how Signal handles group messaging. Open Whisper Systems declined to comment on the record to WIRED about the Ruhr researchers' findings." "In a phone call with WIRED, a W…

And to be honest, it could be better for security not fixing it. This way people will stay with whatsapp and most chats remain e2e encrypted and safe. If Whatsapp breaks these features, people could switch to other messengers without e2e encryption (e.g. Facebook messenger) for group chats.

And for those concerned about the issue, you can monitor the member list and make sure you carefully check all messages. If you're really concerned about encryption that's what you should do anyway.

Re: Attack of the Week: Group Messaging in WhatsApp and Signal

#20

Post by baby »

v1nc wrote: post #9
jgunsch wrote: post #5

Does anyone know what the disclosure story is here? Have WhatsApp and Signal had a chance to respond?

As said here: https://www.wired.com/story/whatsapp-security-flaws-encrypti... "The researchers say that Open Whisper Systems, the non-profit that runs and maintains Signal, nonetheless responded to their work, saying that it's currently redesigning how Signal handles group messaging. Open Whisper Systems declined to comment on the record to WIRED about the Ruhr researchers' findings." "In a phone call with WIRED, a W…

> would likely break a popular WhatsApp feature that allows anyone to join a group simply by clicking on a URL

I think this is false, I wrote that on the Wired thread, but here's a way to fix it:

1. when you create a joining link, it creates a secret uuid

2. this uuid is shared with the rest of the group

3. if Alice joins the group, every uuid created is shared to Alice (except the one Alice used, if Alice used a joining link)

4. when Bob attempts to join the group via the group id, if Bob does not have a known code Bob is refused

5. if Bob uses a known code, Bob is accepted and everyone deletes the code

This does not prevent different participant views to be created, but this is already a problem in WA anyway.

Post reply on HN