Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NSO hacked WhatsApp to spy on top government officials at U.S. allies

reuters.com

Post reply on HN
Print view View original

131–140 of 321 posts

Re: NSO hacked WhatsApp to spy on top government officials at U.S. allies

#131

Post by mullen »

jonplackett wrote: post #104

What are Israel doing to get so good at this and chip design and weapons making and everything else they seem to be really good at? There’s only about 8 million people in the whole country. There are plenty of cities with more people than that. How come they punch so far above their weight?

There is no reason why other well educated countries could being doing the same thing, but with the Israeli's, nothing is off the table. If a company in Israeli learns how to hack WhatsApp, that is seen as an advantage for the Israeli government. If an American company learns how to hack WhatsApp, they bound by ethics to let WhatsApp know and make sure the issue is fixed. Israeli culture thinks that is crazy to do that because they can use the flaw against their enemies.

Re: NSO hacked WhatsApp to spy on top government officials at U.S. allies

#132

Post by wyldfire »

dan-robertson wrote: post #103
vocatus_gate wrote: post #31

Earlier quoted context omitted.

A buddy of mine is Special Forces (U.S.). He said JSOC recently banned use of WhatsApp and encouraged everyone to switch to the open-source Signal (another encrypted messaging app). Allegedly WhatsApp uses Signal's encryption (OpenWhisper) but I stopped trusting it the second Facebook bought them out.

If one assumes that WhatsApp are implementing the protocol as well as signal are (which I do), then I think there are three questions in deciding what is more secure: 1. Do you trust Facebook (or open whisper systems) with your metadata/expect them to delete it? 2. How likely are there to be bugs (in the app, not in the protocol itself) which lead to exploits. On the one hand WhatsApp probably have more people workin…

WhatsApp will rekey and send old messages without notifying the user. This means MITM is possible and not always detectable. This is their intended design (but you can change the preference so that you at least get notified when it happens).

(Widely reported, see Guardian article)

Re: NSO hacked WhatsApp to spy on top government officials at U.S. allies

#133

Post by notyourday »

rshnotsecure wrote: post #53
notyourday wrote: post #47

Earlier quoted context omitted.

Umm.. That's some fun tale. Highwinds - a software company that sold usenet server. 1995 or so. Really high performance one. Later went into usenet hosting. Choopa - a hosting company that started as a porn DVD ripper. When you provide lots of porn, you get lots of connectivity. At which point someone goes "Why don't we sell the excess? We already paying for it" Sounds familiar? LeaseWeb - a really old hosting compan…

Look into something called Reverse Mergers btw. Old dying hosting companies were the perfect cover to be acquired by spy agencies. You’ll notice a large posting of press releases and apparent spending in the last 4-5 years though still for all. http://dcsmanage.com out of Los Angeles is another one btw...

Extraordinary claims require extraordinary evidence.

Re: NSO hacked WhatsApp to spy on top government officials at U.S. allies

#134

Post by kd3 »

Scarbutt wrote: post #114
jonplackett wrote: post #104

What are Israel doing to get so good at this and chip design and weapons making and everything else they seem to be really good at? There’s only about 8 million people in the whole country. There are plenty of cities with more people than that. How come they punch so far above their weight?

Lots and lots of outside money.

Yep especially US "aid".

Re: NSO hacked WhatsApp to spy on top government officials at U.S. allies

#135

Post by mosburger »

kingbirdy wrote: post #52
vocatus_gate wrote: post #35

Earlier quoted context omitted.

WhatsApp allegedly uses an implementation of the OpenWhisper encryption system that Signal created (and still uses). However as there is no source code available unlike Signal, there's no way to verify if WhatsApp "really" is using it (or using it correctly).

Couldn't you determine by looking at the code in the APK, at least for Android?

It might be a bit difficult (but not impossible) to do that... the APK you download is not the APK that the developer uploads to the Play store. Usually, developers upload a "bundle," and then Google optimizes it by stripping out irrelevant media, i18n, etc., to deliver a smaller optimized APK to the end user.

So you can't just generate an MD5 of your APK and match it against the store description like the good old days when you could make sure your Linux ISO was legit, but there's probably some way to make it work?

EDIT: It might be possible to circumvent Google's bundling/optimizing by just uploading a regular old APK, but IIRC that was becoming more difficult these days. Unfortunately I'm not an Android dev expert.

Re: NSO hacked WhatsApp to spy on top government officials at U.S. allies

#136

Post by roywiggins »

est31 wrote: post #100
roywiggins wrote: post #75

Earlier quoted context omitted.

This case is much simpler than that: there was a buffer overflow exploited in WhatsApp clients. https://nvd.nist.gov/vuln/detail/CVE-2019-3568

Oh thanks, this wasn't mentioned in the linked article.

Skimming the actual complaint (unhelpfully, not linked by the article) clears a lot up about what happened.

https://context-cdn.washingtonpost.com/notes/prod/default/do...

Re: NSO hacked WhatsApp to spy on top government officials at U.S. allies

#137

Post by dependenttypes »

cloudyo wrote: post #5

Sometimes you just feel like using Signal instead

There have been a few electron vulnerabilities that affected signal. Plus signal demands that you have a phone number in order to use it. Also the fact that each device has its own key promotes the users to just blindly accept new keys.

Re: NSO hacked WhatsApp to spy on top government officials at U.S. allies

#138

Post by why-oh-why »

dependenttypes wrote: post #130
jonplackett wrote: post #104

What are Israel doing to get so good at this and chip design and weapons making and everything else they seem to be really good at? There’s only about 8 million people in the whole country. There are plenty of cities with more people than that. How come they punch so far above their weight?

I presume that most people will disagree with this but I believe that it is related to Jewish people on average being generally smarter than a non-jewish person. Consider for example: https://en.wikipedia.org/wiki/List_of_Jewish_Nobel_laureates > "Nobel Prizes[note 1] have been awarded to over 900 individuals,[1] of whom at least 20% were Jews, although the Jewish population comprises less than 0.2% of the world's po…

I don’t comment on the “Jewish are smarter” comment but I always attribute their success to their culture and work “mind”.

Sort of similar to how “Asian parents push their children to become doctors.” It’s not necessarily that Asians are smarter, but they do work hard to achieve what they want… statistically speaking.

Re: NSO hacked WhatsApp to spy on top government officials at U.S. allies

#140

Post by chatmasta »

lol768 wrote: post #96
chatmasta wrote: post #85

Earlier quoted context omitted.

I think OP is asking how NSO was able to escape the phone's sandbox model. To do that, they would need an exploit for the phone's OS, in addition to the WhatsApp exploit. So, the obvious question: which operating systems were specifically targeted? Another comment mentions Pegasus... that was an iOS exploit patched in 9.3.5 (3 years ago). Does that line up with the timeline of this article? Given that Android exploit…

>Given that Android exploits are far more common than iOS, I would expect they had one of those too. The Pixel was the only device that was not pwned in the 2017 Mobile Pwn2Own competition - the iPhone, running iOS 11.1, was exploited 4 times via both WiFi and Safari. I'd be incredinly surprised if NSO were able to compromise an up to date Pixel phone.

That’s great for the Pixel. But what percent of Android phones are the Pixel, and not one of the hundreds of other varieties with varying patch schedules?

(That’s not entirely snark. I do wonder how high risk individuals are choosing which devices they use for communication.)

Post reply on HN