Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

US has investigated claims WhatsApp chats aren't private

bloomberg.com

Post reply on HN
Print view View original

151–160 of 387 posts

Re: US has investigated claims WhatsApp chats aren't private

#151

Post by instagib »

youknownothing wrote: post #104

Just to throw in a couple of possibly outlandish theories: 1. as others have said, they could be collecting the encrypted messages and then tried to decrypt them using quantum computing, the Chinese have been reportedly trying to do this for many years now. 2. with metadata and all the information from other sources, they could infer what the conversation is about without the need to decrypt it: if I visit a page (Fa…

2) enough metadata can reveal a person's life, habits, and location which removes the need to analyze the actual bulky content of communications.

can analyze receivers data or receivers contact trees data which is easier to access.

The number of free or paid data sources is daunting.

Re: US has investigated claims WhatsApp chats aren't private

#152

Post by solenoid0937 »

martinralbrecht wrote: post #147
solenoid0937 wrote: post #143

Earlier quoted context omitted.

I don't see why standard RE techniques (DBI/Frida + MITM) wouldn't work, do you? WhatsApp is constantly RE'd because it'd be incredibly valuable to discover gaps in its security posture, the community would find any exfil here.

We did reverse engineer it and we're cryptographers not reverse engineering experts https://eprint.iacr.org/2025/794

Cool paper, thanks for sharing!

Re: US has investigated claims WhatsApp chats aren't private

#153

Post by cosmicgadget »

solenoid0937 wrote: post #143
cosmicgadget wrote: post #141

Earlier quoted context omitted.

I'm technical and work in security. Since it is trivial, please explain. Ideally not using a strawman like "well just run strings and look for uploadPlaintextChatsToServer()".

I don't see why standard RE techniques (DBI/Frida + MITM) wouldn't work, do you? WhatsApp is constantly RE'd because it'd be incredibly valuable to discover gaps in its security posture, the community would find any exfil here.

If people are trivially hooking IOS and Android applications then sure, it's just an exercise in dynamic analysis.

Mobile applications are outside my domain so I am surprised platform security (SEL, attestation, etc.) has been so easily defeated.

Re: US has investigated claims WhatsApp chats aren't private

#154

Post by jlarocco »

xvector wrote: post #52
renegade-otter wrote: post #41

Anyone trusting Facebook to follow basic human decency and, yes, laws, is a fool.

Anyone blindly believing every random allegation is also a fool, especially when the app in question has been thoroughly reverse engineered and you can freely check for yourself that it's using the same protocol as Signal for encryption

That raises the question of why not just use Signal and avoid a company whose founder thinks we're all "dumbfucks" and has a long history of scandals and privacy violations?

The evidence is pretty clear that Facebook wants to do everything they legally can to track and monitor people, and they're perfectly okay crossing the line and going to court to find the boundaries.

Using a company like that for encrypted messaging seems like an unnecessary risk. Maybe they're not decrypting it, but they're undoubtedly tracking everything else about the conversation because that's what they do.

Re: US has investigated claims WhatsApp chats aren't private

#155

Post by quesera »

cosmicgadget wrote: post #138
quesera wrote: post #122

Earlier quoted context omitted.

Reverse engineering is easy when the source code is available. :) The difference between source code in a high-level language, and AArch64 machine language, is surmountable. The effort is made easier if you can focus on calls to the crypto and networking libraries.

The source is available? Understanding program flow is very different from understanding the composition of data passing though the program.

At some level, the machine code is the source code -- but decompiling AArch64 mobile apps into something like Java is common practice.

As GP alludes, you would be looking for a secondary pathway for message transmission. This would be difficult to hide in AArch64 code (from a skilled practitioner), and extra difficult in decompiled Java.

It would be "easy" enough, and an enormous prize, for anyone in the field.

Re: US has investigated claims WhatsApp chats aren't private

#156

Post by cosmicgadget »

quesera wrote: post #155
cosmicgadget wrote: post #138

Earlier quoted context omitted.

The source is available? Understanding program flow is very different from understanding the composition of data passing though the program.

At some level, the machine code is the source code -- but decompiling AArch64 mobile apps into something like Java is common practice. As GP alludes, you would be looking for a secondary pathway for message transmission. This would be difficult to hide in AArch64 code (from a skilled practitioner), and extra difficult in decompiled Java. It would be "easy" enough, and an enormous prize, for anyone in the field.

I am familiar with disassembly and decompilation and what you just said is a huge handwave.

> a secondary pathway for message transmission

That's certainly the only way messages could be uploaded to Facebook!

Re: US has investigated claims WhatsApp chats aren't private

#157

Post by quesera »

cosmicgadget wrote: post #156
quesera wrote: post #155

Earlier quoted context omitted.

At some level, the machine code is the source code -- but decompiling AArch64 mobile apps into something like Java is common practice. As GP alludes, you would be looking for a secondary pathway for message transmission. This would be difficult to hide in AArch64 code (from a skilled practitioner), and extra difficult in decompiled Java. It would be "easy" enough, and an enormous prize, for anyone in the field.

I am familiar with disassembly and decompilation and what you just said is a huge handwave. > a secondary pathway for message transmission That's certainly the only way messages could be uploaded to Facebook!

I'm curious why you think it's handwavy.

I've done this work on other mobile apps (not WhatsApp), and the work is not out of the ordinary.

It's difficult to hide subtleties in decompiled code. And anything that looks hairbally gets special attention, if the calling sites or side effects are interesting.

(edit for edit)

> That's certainly the only way messages could be uploaded to Facebook!

Well, there's a primary pathway which should be very obvious. And if there's a secondary pathway, it's probably for telemetry etc. If there are others, or if it isn't telemetry, you dig deeper.

All secrets are out in the open at that point. There are no black boxes in mobile app code.

Re: US has investigated claims WhatsApp chats aren't private

#158

Post by conscion »

gruez wrote: post #84
cosmicgadget wrote: post #32

> “We look forward to moving forward with those claims and note WhatsApp’s denials have all been carefully worded in a way that stops short of denying the central allegation in the complaint – that Meta has the ability to read WhatsApp messages, regardless of its claims about end-to-end encryption.” My money is on the chats being end to end encrypted and separately uploaded to Facebook.

>being end to end encrypted and separately uploaded to Facebook That's a cute loophole you thought up, but whatsapp's marketing is pretty unequivocal that they can't read your messages. >With end-to-end encryption on WhatsApp, your personal messages and calls are secured with a lock. Only you and the person you're talking to can read or listen to them, and no one else, not even WhatsApp https://www.whatsapp.com/ That…

My guess is that they are end-to-end encrypted. And because of Facebook's scale that they're able to probabilisticly guess at what's in the encrypted messages (e.g.a message with X hash has Y probability of containing the word "shoes")

Re: US has investigated claims WhatsApp chats aren't private

#159

Post by p1anecrazy »

gruez wrote: post #90
vbezhenar wrote: post #87

Whatsapp is considered insecure and banned from use for military in Russia. Telegram, on the other hand, is widely used. Of course that's not something definitive, but just a food for thought.

> but just a food for thought. ...that telegram is backdoored by the russians? The implication you're trying to make seems to be that russians must be choosing telegram because it's secure, but are ignoring the possibility that they're choosing telegram because they have access to it. After all, you think they want the possibility of their military scheming against them?

I guess their point was that Russian military doesn‘t care if Russian intelligence reads their messages

Re: US has investigated claims WhatsApp chats aren't private

#160

Post by rsync »

londons_explore wrote: post #8

I want whatsapp to decrypt the messages in a secure enclave and render the message content to the screen with a secure rendering pipeline, as is done with DRM'ed video. Compromise of the client side application or OS shouldn't break the security model. This should be possible with current API's, since each message could if needed simply be a single frame DRM'ed video if no better approach exists (or until a better ap…

“I want whatsapp to decrypt the messages in a secure enclave and render the message content to the screen with a secure rendering pipeline, as is done with DRM'ed video.“

If you are sophisticated enough to understand, and want, these things (and I believe that you are) …

… then why would you want to use WhatsApp in the first place?

Post reply on HN