Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WhatsApp is using your IMEI number as password

samgranger.com

Post reply on HN
Print view View original

21–30 of 83 posts

Re: WhatsApp is using your IMEI number as password

#21

Post by rjzzleep »

mobweb wrote: post #16

If you installed WhatsApp on an Android device for example, your password is likely to be an inverse of your phones IMEI number with an MD5 encryption thrown on top of it (without salt). How does OP know this? Was there a leak of "passwords" or did he find this through trial & error? Edit: Just found out that's what it says even on the Wikipedia entry about WhatsApp[1]. [1]: http://en.wikipedia.org/wiki/WhatsApp

it's called reverse engineering though. it's much easier to use reverse ios code than that weirdass dex format though imho

Re: WhatsApp is using your IMEI number as password

#22

Post by galadriel »

deltaqueue wrote: post #17

An "Ask HN" that's somewhat related: Is Facebook doing something similar on Android? I have left an application update pending for weeks because Facebook requires access to Phone Calls , which allows the application to "determine the phone number and serial number of this phone, whether a call is active, the number that call is connected to and the like." This does not sit well with me.

I also don't allow any app requiring those details (unless they are needed obviously, like VoIP), but I think what most companies want is the unique serial number, so they can keep a track of how many unique devices are used by them. But since Android does not gives permission at more granular level, I simply don't install any such app, or don't upgrade one which ask for it.

As for Facebook, I am using Tinfoil for Facebook app (It is a website wrapper, essentially). It was faster than whatever app Facebook managed to write.

Re: WhatsApp is using your IMEI number as password

#23

Post by RKearney »

m_eiman wrote: post #15
kristofferR wrote: post #9

Earlier quoted context omitted.

Sure. On iPhones, try 3001#12345# . On Android it often depends on the specific model you have. Here are some for the Samsung S3: #06# Show IMEI number #0 # LCD Test Menu # #4636# #* user statistics and Phone Info #0011# Displays status information for the GSM #1234# View SW Version PDA, CSC, MODEM #12580 369# SW & HW Info #197328640# Service Mode #32489# (Ciphering Info) #232337# Bluetooth Address #232331# Bluetooth…

##7780## * Factory reset This seems a bit dangerous. Does it require any kind of password?

I just tried it on an HTC Incredible 2 on Verizon. Nothing happened. No error message, just back to the dialer.

EDIT: I see now it was stated these are SIII specific. Guess that explains why nothing happened for me.

Re: WhatsApp is using your IMEI number as password

#24

Post by thebigpicture »

Asking users to participate in "two-factor authentication" seems like a great way to match people's personal information to particular devices.

So maybe we have a double-edged sword here. If you want to be able to authenticate you have to give some company the ability to track you and monitor all your activity (which they will try to "monetize"). It sounds sort of tinfoil hat but this is what we are facing.

The reason: We insist on using the web and other "client-server" approaches for almost everything we do using the internet, instead of considering end-to-end, peer-to-peer approaches. Things are so insecure when everyting goes (mostly) unencrypted over the open web via middleman (Facebook servers, Gmail servers, etc.) that we need to try things like "two-factor authentication".

Re: WhatsApp is using your IMEI number as password

#26

Post by dutchbrit »

namuorg wrote: post #20

From your post, it seems like you didn't contact WhatsApp before publishing this post. What was your reasoning for going public with this vulnerability before at least trying to contact them and giving them a chance to resolve the issue?

I sent them a message a few days ago, but didn't receive a reply (yet).

Re: WhatsApp is using your IMEI number as password

#28

Post by CrazyRobot »

This actually seems to me like a perfect solution (from WhatsApp's side). This way as long the user has the same phone number, he/she doesn't have to remember any credentials, which is probably the main reason (or one of the top 3) for people using WhatsApp in the first place.

And as for the "security problem", if someone has access to your phone they can just maliciously use the app itself. I'm not saying that this should just be ignored, but in this specific case the author had probably created the bigger part of the security threat by publishing the article.

Re: WhatsApp is using your IMEI number as password

#29

Post by aw3c2 »

CrazyRobot wrote: post #28

This actually seems to me like a perfect solution (from WhatsApp's side). This way as long the user has the same phone number, he/she doesn't have to remember any credentials, which is probably the main reason (or one of the top 3) for people using WhatsApp in the first place. And as for the "security problem", if someone has access to your phone they can just maliciously use the app itself. I'm not saying that this…

An unsalted(!) md5(!) is never a perfect solution unless your goal is insecurity. The idea of using the IMEI as unique device dependant string for hash generation is good but you must make it impossible for anyone to find out how the hash is created or it is a glaring security hole (as demonstrated).

Many many apps have permissions to read the IMEI. Just as many have access to the internet. Add whatever permission is needed to find out the device's phone number and you have all you need.

Re: WhatsApp is using your IMEI number as password

#30

Post by LaGrange »

namuorg wrote: post #20

From your post, it seems like you didn't contact WhatsApp before publishing this post. What was your reasoning for going public with this vulnerability before at least trying to contact them and giving them a chance to resolve the issue?

This is a well-known design decision on their side. This is not as much a discovery as bringing it up.
Post reply on HN