Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NSO hacked WhatsApp to spy on top government officials at U.S. allies

reuters.com

Post reply on HN
Print view View original

71–80 of 321 posts

Re: NSO hacked WhatsApp to spy on top government officials at U.S. allies

#71

Post by soulofmischief »

vocatus_gate wrote: post #31
milofeynman wrote: post #9

The article doesn't really say what hackers had access to, but it sounds like they had full control over their phones. There is a lot bigger story here and I'd love to read a post-mortem in a few months. Also, WhatsApp is such an obvious target for a state actor. I saw several articles of the last year that mentioned Jared Kushner using Whatsapp so I assume a lot of government folks use it for off the books "encrypte…

A buddy of mine is Special Forces (U.S.). He said JSOC recently banned use of WhatsApp and encouraged everyone to switch to the open-source Signal (another encrypted messaging app). Allegedly WhatsApp uses Signal's encryption (OpenWhisper) but I stopped trusting it the second Facebook bought them out.

Facebook didn't buy Signal. One of the original executives from Facebook left to help start the Signal foundation with Moxie precisely because he had become sick of Facebook's insane behavior.

Re: NSO hacked WhatsApp to spy on top government officials at U.S. allies

#72

Post by zer0tonin »

rshnotsecure wrote: post #42
galazzah wrote: post #22

Earlier quoted context omitted.

Can you provide any sources? Surprised to see Credit Karma on here...

It comes mainly from mapping the subdomains over time and analysis of the ASNs. This is key. You will often see a company with perhaps 200 or so subdomains, that only does business in the United States. But then you will see one subdomain that maps to ASN 4803 or whatever, which then leads to “China Telecom xinjiang”. In fact I encourage you to type: org:”China Telecom xinjiang” “NSFOCUS” into Shodan. Also look at th…

> org:”China Telecom xinjiang” “NSFOCUS” into Shodan.

I'm going to admit I didn't try putting this into Shodan because for whatever reason I don't have access to it right now. But won't this just show a list of servers running a NSFOCUS WAF? How do you connect that to ProtonMail or LeaseWeb?

Re: NSO hacked WhatsApp to spy on top government officials at U.S. allies

#73

Post by godelski »

rshnotsecure wrote: post #63
ChuckMcM wrote: post #51

Earlier quoted context omitted.

So you're saying "typical intelligence analyst stuff" is the reasoning here? Generally analysts produce questions which operations runs down to figure out if what they think is going on, is actually going on. Correct me if I'm wrong here but you're basically saying that you have done the first part and found some suspicious links but not the second part do develop actual evidence one way or the other, is that a fair…

I am writing this all on a phone and I am more than happy to produce a 5000 word report which will be posted in 96 hours. I will follow up via a comment here and also send to Michael Forsythe at the New York Times for additional review. You have my word. EDIT: 5000 words not pages

If you make a post (assuming I see it, because I want to) I'll gladly read (and upvote) it. I think this is exactly the kind of thing HN wants to see.

Re: NSO hacked WhatsApp to spy on top government officials at U.S. allies

#74

Post by callalex »

laegooose wrote: post #62

I hate facebook just like everyone else, but doesn't it have more resources to spend on WhatsApp security than Signal Foundation? Yes, Signal is open-source, but how many people are actually looking for its vulnerabilities full-time?

Just because Facebook can doesn’t mean they will. Justifying security research budgets is notoriously difficult in the corporate world.

Re: NSO hacked WhatsApp to spy on top government officials at U.S. allies

#75

Post by roywiggins »

est31 wrote: post #69
freeplay wrote: post #17

But I thought WhatsApp was end-to-end encrypted?

It is, but when you create a new contact you are trusting the WhatsApp service that the public key of the other party actually is their public key. The service can always give both parties a key of their own making instead of the actual keys of the parties. IIRC you can verify the public keys via QR codes but maybe such verification wasn't part of security practices. Thus if you hack the service, you may be able to r…

This case is much simpler than that: there was a buffer overflow exploited in WhatsApp clients.

https://nvd.nist.gov/vuln/detail/CVE-2019-3568

Re: NSO hacked WhatsApp to spy on top government officials at U.S. allies

#76

Post by roywiggins »

sillysaurusx wrote: post #21
freeplay wrote: post #17

But I thought WhatsApp was end-to-end encrypted?

E2E provides protection against the server provider knowing your content. It doesn't protect either end, since that would be impossible. In this case, it seems like WhatsApp itself was compromised; malware was distributed through the server directly to the app, or something along those lines. (Y'know how you can dynamically change apps nowadays using Codepush, etc? If Whatsapp had something like that in their pipelin…

My understanding is it was this buffer overflow vulnerability:

https://nvd.nist.gov/vuln/detail/CVE-2019-3568

Re: NSO hacked WhatsApp to spy on top government officials at U.S. allies

#77

Post by snazz »

soulofmischief wrote: post #71
vocatus_gate wrote: post #31

Earlier quoted context omitted.

A buddy of mine is Special Forces (U.S.). He said JSOC recently banned use of WhatsApp and encouraged everyone to switch to the open-source Signal (another encrypted messaging app). Allegedly WhatsApp uses Signal's encryption (OpenWhisper) but I stopped trusting it the second Facebook bought them out.

Facebook didn't buy Signal. One of the original executives from Facebook left to help start the Signal foundation with Moxie precisely because he had become sick of Facebook's insane behavior.

I think you misinterpreted the parent comment—I read it to mean that they stopped trusting WhatsApp as soon as Facebook bought them despite using the same technology as Signal. Your interpretation might be right, though.

Re: NSO hacked WhatsApp to spy on top government officials at U.S. allies

#78

Post by chatmasta »

blotter_paper wrote: post #16

Which is hilarious and hypocritical, since the government keeps talking about making end-to-end encryption apps illegal to distribute without backdoors. Now they're using an encryption app with a backdoor,* and they're upset about it? I thought this is what they wanted! *I know, I know, this probably wasn't done with a backdoor -- it's just funnier to lie in this context.

In fact, demonstrating this point is probably part of the reason Facebook is litigating this case. It gives them a solid example of the risks of backdoors that they can point to when governments ask for them.

Re: NSO hacked WhatsApp to spy on top government officials at U.S. allies

#79

Post by dylan604 »

maximente wrote: post #43
blotter_paper wrote: post #27

Earlier quoted context omitted.

I mean, Signal is open source and not owned by Facebook, so I'm not sure why anybody uses WhatsApp instead.

they have features signal has not yet copied and probably won't (statuses e.g.)

The main one being actual users

Re: NSO hacked WhatsApp to spy on top government officials at U.S. allies

#80

Post by criley2 »

blotter_paper wrote: post #16

Which is hilarious and hypocritical, since the government keeps talking about making end-to-end encryption apps illegal to distribute without backdoors. Now they're using an encryption app with a backdoor,* and they're upset about it? I thought this is what they wanted! *I know, I know, this probably wasn't done with a backdoor -- it's just funnier to lie in this context.

The real irony comes from an Administration who ran on the odious idea of "locking up" government employees who mishandled communications, who then turns around and begins a mass campaign of mishandling communications...
Post reply on HN