Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WhatsApp Security Vulnerability

schneier.com

Post reply on HN
Print view View original

11–20 of 71 posts

Re: WhatsApp Security Vulnerability

#11

Post by frabbit »

beambot wrote: post #8
ckastner wrote: post #5

The article mostly just quotes two other sources that have already been discussed here: WhatsApp backdoor allows snooping on encrypted messages , https://news.ycombinator.com/item?id=13389935 There is no WhatsApp 'backdoor' , https://news.ycombinator.com/item?id=13394900

Yep, this is an analysis by a trusted individual in the security field. His ultimate summary: > [WhatsApp's representative is] technically correct. This is not a backdoor. This really isn't even a flaw. It's a design decision that put usability ahead of security in this particular instance.

Or to re-phrase:

This security application is not secure but it is usable.

Re: WhatsApp Security Vulnerability

#12

Post by mschuster91 »

pfg wrote: post #10
mschuster91 wrote: post #9

Earlier quoted context omitted.

A plausible attack scenario, outlined in multiple steps: 1) Police arrest a drug dealer, who manages to turn his phone off by smashing it on the floor and the battery pops out, in the same step also locking the data from readout if the device is using FDE 2) Cops now take the SIM card, compel the provider to provide the PUK to unlock the SIM card and insert it into their own smartphone 3) Cops activate WhatsApp and n…

That's why WhatsApp allows you to verify your recipient's key out of band. The scenario you describe would cause the identity key to change and trigger a notification if one of the potential clients has that option enabled. There's really no way to avoid out-of-band key verification in end-to-end encrypted messaging unless you fully trust the service. Other than that, the best you can hope for is after-the-fact detec…

> The scenario you describe would cause the identity key to change and trigger a notification if one of the potential clients has that option enabled.

But only for messages sent by the sender AFTER the key-change notification. Those still in the send queue get re-encrypted with the new key of the cop phone and then resent without confirmation, and this is the attack window and the bug!

Oh, and most people don't enable the key-change notification anyway so they won't even know that their dealer got arrested.

Re: WhatsApp Security Vulnerability

#13

Post by pfg »

mschuster91 wrote: post #12
pfg wrote: post #10

Earlier quoted context omitted.

That's why WhatsApp allows you to verify your recipient's key out of band. The scenario you describe would cause the identity key to change and trigger a notification if one of the potential clients has that option enabled. There's really no way to avoid out-of-band key verification in end-to-end encrypted messaging unless you fully trust the service. Other than that, the best you can hope for is after-the-fact detec…

> The scenario you describe would cause the identity key to change and trigger a notification if one of the potential clients has that option enabled. But only for messages sent by the sender AFTER the key-change notification. Those still in the send queue get re-encrypted with the new key of the cop phone and then resent without confirmation, and this is the attack window and the bug! Oh, and most people don't enabl…

Sorry, I was thinking under the premise of a hypothetical version of WhatsApp where this behaviour was changed, since that's what OP was referring to. In that scenario, I don't see where the gaping hole is.

Re: WhatsApp Security Vulnerability

#14

Post by aylons »

While people discuss about a possible state-actor stronghanding WhatsApp and the semantics of backdoor, the "design feature" of not showing the key changes are making real victims, at least in Brasil:

The attacker first try to duplicate the mobile phone number of the first victim, probably by social engineering their phone company. This part may look difficult to do, but it is not hard if you realize you do not need to target anyone special - everyone uses WhatsApp, so any number gives a high probability of success.

After getting the first victim number, the attacker install WhatsApp, which gladly verifies the user via SMS - WA has no login, no password, so anyone receiving the SMS can impersonate anyone else.

As Whatsapp does not send any alert of key change by default, the attacker is free to impersonate to person - in this case, he simply asks for some borrowed money to be transferred to a bank account, which will be paid soon. The recipient has no reason to distrust the message - it is being sent by his friend in the same chat window as they always talked to, even the logs are there. There is no message to warn about the potential issue, by design!

This is no hypothesis - this is actually happening for some time, now.[1] This design feature surely has some loyal users.

[1]http://www.correiobraziliense.com.br/app/noticia/cidades/201...

Re: WhatsApp Security Vulnerability

#15

Post by FabHK »

pfg wrote: post #10
mschuster91 wrote: post #9

Earlier quoted context omitted.

A plausible attack scenario, outlined in multiple steps: 1) Police arrest a drug dealer, who manages to turn his phone off by smashing it on the floor and the battery pops out, in the same step also locking the data from readout if the device is using FDE 2) Cops now take the SIM card, compel the provider to provide the PUK to unlock the SIM card and insert it into their own smartphone 3) Cops activate WhatsApp and n…

That's why WhatsApp allows you to verify your recipient's key out of band. The scenario you describe would cause the identity key to change and trigger a notification if one of the potential clients has that option enabled. There's really no way to avoid out-of-band key verification in end-to-end encrypted messaging unless you fully trust the service. Other than that, the best you can hope for is after-the-fact detec…

> The scenario you describe would cause the identity key to change and trigger a notification if one of the potential clients has that option enabled.

... and that notification would be shown after that potential client's WhatsApp client had re-encrypted the undelivered messages and re-sent them.

Re: WhatsApp Security Vulnerability

#16

Post by pfg »

FabHK wrote: post #15
pfg wrote: post #10

Earlier quoted context omitted.

That's why WhatsApp allows you to verify your recipient's key out of band. The scenario you describe would cause the identity key to change and trigger a notification if one of the potential clients has that option enabled. There's really no way to avoid out-of-band key verification in end-to-end encrypted messaging unless you fully trust the service. Other than that, the best you can hope for is after-the-fact detec…

> The scenario you describe would cause the identity key to change and trigger a notification if one of the potential clients has that option enabled. ... and that notification would be shown after that potential client's WhatsApp client had re-encrypted the undelivered messages and re-sent them.

Yes, but this thread starts with "Even if they changed this specific design decision/vulnerability, it seems like there's a big gaping hole (or I'm missing something)."

I don't see how WhatsApp would be vulnerable in this scenario assuming they change this behaviour, but OP claims there's still a big gaping hole.

Re: WhatsApp Security Vulnerability

#17

Post by noja »

frabbit wrote: post #11
beambot wrote: post #8

Earlier quoted context omitted.

Yep, this is an analysis by a trusted individual in the security field. His ultimate summary: > [WhatsApp's representative is] technically correct. This is not a backdoor. This really isn't even a flaw. It's a design decision that put usability ahead of security in this particular instance.

Or to re-phrase: This security application is not secure but it is usable.

There is no "secure", it's a scale from "no security" to just "very high security".

Re: WhatsApp Security Vulnerability

#18

Post by StavrosK »

aylons wrote: post #14

While people discuss about a possible state-actor stronghanding WhatsApp and the semantics of backdoor, the "design feature" of not showing the key changes are making real victims, at least in Brasil: The attacker first try to duplicate the mobile phone number of the first victim, probably by social engineering their phone company. This part may look difficult to do, but it is not hard if you realize you do not need…

Unfortunately, if WhatsApp did defend against this, it would be such a big hassle that users would disable it. How many people do you know that wouldn't just click "accept" on "this user's keys changed", or wouldn't just ask the attacker "hey did you get a new phone?" "yes" "oh okay"?

People love to blame WhatsApp, but what can anyone realistically do?

Re: WhatsApp Security Vulnerability

#19

Post by sschueller »

mschuster91 wrote: post #12
pfg wrote: post #10

Earlier quoted context omitted.

That's why WhatsApp allows you to verify your recipient's key out of band. The scenario you describe would cause the identity key to change and trigger a notification if one of the potential clients has that option enabled. There's really no way to avoid out-of-band key verification in end-to-end encrypted messaging unless you fully trust the service. Other than that, the best you can hope for is after-the-fact detec…

> The scenario you describe would cause the identity key to change and trigger a notification if one of the potential clients has that option enabled. But only for messages sent by the sender AFTER the key-change notification. Those still in the send queue get re-encrypted with the new key of the cop phone and then resent without confirmation, and this is the attack window and the bug! Oh, and most people don't enabl…

How does Whatsapp re-encrypt a message if they aren't supposed to have a key to decrypt? Is this done on the senders phone? Is it possible to re-encrypt within decrypting?

Re: WhatsApp Security Vulnerability

#20

Post by aylons »

StavrosK wrote: post #18
aylons wrote: post #14

While people discuss about a possible state-actor stronghanding WhatsApp and the semantics of backdoor, the "design feature" of not showing the key changes are making real victims, at least in Brasil: The attacker first try to duplicate the mobile phone number of the first victim, probably by social engineering their phone company. This part may look difficult to do, but it is not hard if you realize you do not need…

Unfortunately, if WhatsApp did defend against this, it would be such a big hassle that users would disable it. How many people do you know that wouldn't just click "accept" on "this user's keys changed", or wouldn't just ask the attacker "hey did you get a new phone?" "yes" "oh okay"? People love to blame WhatsApp, but what can anyone realistically do?

It does not need to be a modal form - a notification message, embedded in the the chat log, just before a "Hey, could you send me some money", could make some people think twice before transferring:

"Wow, he is asking me in excess of USD500 just after WhatsApp warned me his cell phone has changed. Weird".

The simple alert shown in moxie's own blog post [1], perhaps less cryptically written, would probably do the job.

Heck, if this happened between me and girlfriend last week, I would most probably fall, as I did not know this was disabled in WhatsApp. Now, at least, I have turned the notification on.

[1] https://whispersystems.org/blog/images/whatsapp-keychange.pn...

Post reply on HN