Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NSO hacked WhatsApp to spy on top government officials at U.S. allies

reuters.com

Post reply on HN
Print view View original

261–270 of 321 posts

Re: NSO hacked WhatsApp to spy on top government officials at U.S. allies

#261

Post by lowtto »

rshnotsecure wrote: post #63
ChuckMcM wrote: post #51

Earlier quoted context omitted.

So you're saying "typical intelligence analyst stuff" is the reasoning here? Generally analysts produce questions which operations runs down to figure out if what they think is going on, is actually going on. Correct me if I'm wrong here but you're basically saying that you have done the first part and found some suspicious links but not the second part do develop actual evidence one way or the other, is that a fair…

I am writing this all on a phone and I am more than happy to produce a 5000 word report which will be posted in 96 hours. I will follow up via a comment here and also send to Michael Forsythe at the New York Times for additional review. You have my word. EDIT: 5000 words not pages

That's the spirit. I've always loved a good challenge accepted attitude.

Re: NSO hacked WhatsApp to spy on top government officials at U.S. allies

#262

Post by thinkloop »

lern_too_spel wrote: post #169
dan-robertson wrote: post #103

Earlier quoted context omitted.

If one assumes that WhatsApp are implementing the protocol as well as signal are (which I do), then I think there are three questions in deciding what is more secure: 1. Do you trust Facebook (or open whisper systems) with your metadata/expect them to delete it? 2. How likely are there to be bugs (in the app, not in the protocol itself) which lead to exploits. On the one hand WhatsApp probably have more people workin…

Even of they implement the Signal protocol, they have additional modifications to support ads, which increases the attack surface.

Does WhatsApp have ads?

Re: NSO hacked WhatsApp to spy on top government officials at U.S. allies

#263

Post by antpls »

tomcooks wrote: post #113

Use Matrix (Riot.im is a great client) Or Signal, but without the phone number signup

From what I read, NSO didn't only hack Whatsapp, they also used vulnerabilities in the Android OS in the media decoder. Given all the CVEs patched on each Android security patch, that wouldn't be surprising.

If that's the case, the articles are focusing too much on WhatsApp failure, but not enough on the failure of the Android OS. To me there is some kind of shared responsibility between the app and the OS here.

Who knows how many CVEs are hiding in the Signal and Riot.im apps? And Riot.im asks for many permission...

Re: NSO hacked WhatsApp to spy on top government officials at U.S. allies

#264

Post by pnako »

opkr wrote: post #188
rshnotsecure wrote: post #15

Dozens of tech companies around the world that were established in the last 4-5 years were done so entirely for the purpose of being fronts for spy agencies to engage in the vast collection of data. This extends also to shipping, licensing, and auditing companies. One example is https://www.pacificbasin.com/en/fleet/fleet.php Somehow they’ve managed to assemble the worlds 2nd largest cargo fleet in terms of dry weigh…

The rise in shipping company fronts may potentially be attributed to miniature nuclear weapons payloads within shipping containers for rapid and unstoppable payload delivery at close proximity to enemy lines. Btw intelligence agencies are using invisible image watermarking technologies to track users.

I think it's more likely to be a front for the black market in UFO parts being traded between US, Russia and China.

Re: NSO hacked WhatsApp to spy on top government officials at U.S. allies

#265

Post by J_cst »

rshnotsecure wrote: post #63
ChuckMcM wrote: post #51

Earlier quoted context omitted.

So you're saying "typical intelligence analyst stuff" is the reasoning here? Generally analysts produce questions which operations runs down to figure out if what they think is going on, is actually going on. Correct me if I'm wrong here but you're basically saying that you have done the first part and found some suspicious links but not the second part do develop actual evidence one way or the other, is that a fair…

I am writing this all on a phone and I am more than happy to produce a 5000 word report which will be posted in 96 hours. I will follow up via a comment here and also send to Michael Forsythe at the New York Times for additional review. You have my word. EDIT: 5000 words not pages

That's a bookmark

Re: NSO hacked WhatsApp to spy on top government officials at U.S. allies

#266

Post by dchest »

vocatus_gate wrote: post #99
snazz wrote: post #77

Earlier quoted context omitted.

I think you misinterpreted the parent comment—I read it to mean that they stopped trusting WhatsApp as soon as Facebook bought them despite using the same technology as Signal. Your interpretation might be right, though.

No, you're correct. I stopped trusting WhatsApp after the Facebook acquisition.

FYI, WhatsApp added end-to-end encryption after Facebook acquisition.

Re: NSO hacked WhatsApp to spy on top government officials at U.S. allies

#267

Post by casefields »

dan-robertson wrote: post #106
milofeynman wrote: post #9

The article doesn't really say what hackers had access to, but it sounds like they had full control over their phones. There is a lot bigger story here and I'd love to read a post-mortem in a few months. Also, WhatsApp is such an obvious target for a state actor. I saw several articles of the last year that mentioned Jared Kushner using Whatsapp so I assume a lot of government folks use it for off the books "encrypte…

Based on the U.K. news, approximately everyone in parliament uses WhatsApp to talk/scheme with one another

Not just the UK, most international diplomacy is done through Whatsapp: https://www.theguardian.com/technology/2016/nov/04/why-do-di...

Re: NSO hacked WhatsApp to spy on top government officials at U.S. allies

#268

Post by Angostura »

dan-robertson wrote: post #103
vocatus_gate wrote: post #31

Earlier quoted context omitted.

A buddy of mine is Special Forces (U.S.). He said JSOC recently banned use of WhatsApp and encouraged everyone to switch to the open-source Signal (another encrypted messaging app). Allegedly WhatsApp uses Signal's encryption (OpenWhisper) but I stopped trusting it the second Facebook bought them out.

If one assumes that WhatsApp are implementing the protocol as well as signal are (which I do), then I think there are three questions in deciding what is more secure: 1. Do you trust Facebook (or open whisper systems) with your metadata/expect them to delete it? 2. How likely are there to be bugs (in the app, not in the protocol itself) which lead to exploits. On the one hand WhatsApp probably have more people workin…

Keep in mind also that WhatsApp also demands full access to ALL your contacts in order to really work properly, as opposed to Signal where you just add the people you want to use Signal with

Re: NSO hacked WhatsApp to spy on top government officials at U.S. allies

#269

Post by eru »

egeozcan wrote: post #259
eru wrote: post #246

Earlier quoted context omitted.

Security by using obscure software has its own problems, alas. You have less eyeballs looking for exploits on the good guys side as well. So problems stay open.

Within my experience, security by obscurity works only if you're low profile. If significant amounts of money will be spent decrypting your mess, it's game over. OTOH, we usually only hear about the failed attempts, so there's a selection bias.

I deliberately didn't use the phrase security by obscurity, because that usage of obscurity is synonymous with secrecy. And that's not what the original comment was about.

I agree about the low profile being necessary (even if not sufficient).

Re: NSO hacked WhatsApp to spy on top government officials at U.S. allies

#270

Post by eru »

wolco wrote: post #258
eru wrote: post #246

Earlier quoted context omitted.

Security by using obscure software has its own problems, alas. You have less eyeballs looking for exploits on the good guys side as well. So problems stay open.

The more obsure and different the less likely. If closed source the knowledge belongs to the creators. If the circle is extremely small the chance of that knowledge being shared with your enemy is low. It goes up when that circle is increased. When you want the biggest circle open source is safer. If your circle is small closed will be safer.

Your enemy can often learn those secrets not by being shared, but by other means. Eg reverse engineering.

But in any case, the original comment was using 'obscure' in the sense of uncommon not in the sense of 'secret'. As far as I can tell.

Post reply on HN