Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WhatsApp voice calls were used to inject spyware on phones

ft.com

Post reply on HN
Print view View original

161–170 of 313 posts

Re: WhatsApp voice calls were used to inject spyware on phones

#161

Post by [deleted] »

strictfp wrote: post #139
dash2 wrote: post #132

Earlier quoted context omitted.

Hmm, I don’t want to get into a state wickedness bidding war, but the US/Israel are democracies where you are unlikely to be eg locked up without a fair trial. Contrast with the fate of the Uighurs. In foreign policy it’s more balanced (supporting Syria vs Saudi Arabia) but even there, Russia is clearly trying to subvert foreign democracies. China is (perhaps reasonably) pushing for more power in Asia. And while the…

Story time. A close friend of mine was held in custody in the US based on false accusations by a police officer. The police officer later admitted the false accusations to the judge, that he just wanted to "scare him a bit". The judge nodded, proceeded to aquit him of all offenses exept the speeding ticket which he deserved, and off he went.

[deleted]

Re: WhatsApp voice calls were used to inject spyware on phones

#162

Post by bigiain »

orbifold wrote: post #140
bigiain wrote: post #91

Earlier quoted context omitted.

From my favourite Usenix paper ( https://www.usenix.org/system/files/1401_08-12_mickens.pdf ): Basically, you’re either dealing with Mossad or not-Mossad. If your adversary is not-Mossad, then you’ll probably be fine if you pick a good password and don’t respond to emails from ChEaPestPAiNPi11s@virus-basket.biz.ru. If your adversary is the Mossad, YOU’RE GONNA DIE AND THERE’S NOTHING THAT YOU CAN DO ABOUT IT. The Mos…

Fun fact: The mossad ran a job ad on facebook a while ago, which involved a sequence of riddles. First discover a server based on some random seeming sequence of characters on an image. Then you had to solve a number of programming puzzles. I stopped at the third one, because I don't actually want to work there.

And now orbifold is on one of their lists...

Have fun in the submarine!

Re: WhatsApp voice calls were used to inject spyware on phones

#163

Post by FigmentEngine »

timobet wrote: post #154
golergka wrote: post #146

Earlier quoted context omitted.

As another israeli - certainly a good thing. For a nation in our position, in a deeply hostile region, where a major military defeat is certain to be genocide, doing everything possible for national defence is the only way possible to survive. Stuxnet in particular is something that I'm extremely proud of.

You say this as your country is invading and occupying land that doesn’t belong to them and murdering innocents to drive them out. Yeah, nice way to be proud.

very hard to think of any country that has NOT done this. History shows that people and their countries do bad things.

Re: WhatsApp voice calls were used to inject spyware on phones

#164

Post by Krasnol »

strictfp wrote: post #139
dash2 wrote: post #132

Earlier quoted context omitted.

Hmm, I don’t want to get into a state wickedness bidding war, but the US/Israel are democracies where you are unlikely to be eg locked up without a fair trial. Contrast with the fate of the Uighurs. In foreign policy it’s more balanced (supporting Syria vs Saudi Arabia) but even there, Russia is clearly trying to subvert foreign democracies. China is (perhaps reasonably) pushing for more power in Asia. And while the…

Story time. A close friend of mine was held in custody in the US based on false accusations by a police officer. The police officer later admitted the false accusations to the judge, that he just wanted to "scare him a bit". The judge nodded, proceeded to aquit him of all offenses exept the speeding ticket which he deserved, and off he went.

Yeah that's local corruption and still far away from what the Uigurs have to go through which is state policy.

Re: WhatsApp voice calls were used to inject spyware on phones

#165

Post by golergka »

timobet wrote: post #154
golergka wrote: post #146

Earlier quoted context omitted.

As another israeli - certainly a good thing. For a nation in our position, in a deeply hostile region, where a major military defeat is certain to be genocide, doing everything possible for national defence is the only way possible to survive. Stuxnet in particular is something that I'm extremely proud of.

You say this as your country is invading and occupying land that doesn’t belong to them and murdering innocents to drive them out. Yeah, nice way to be proud.

Well, that's your interpretation of the events, and one-sided and not a very truthful one at best.

Re: WhatsApp voice calls were used to inject spyware on phones

#166

Post by [deleted] »

dbrgn wrote: post #142
dash2 wrote: post #132

Earlier quoted context omitted.

Hmm, I don’t want to get into a state wickedness bidding war, but the US/Israel are democracies where you are unlikely to be eg locked up without a fair trial. Contrast with the fate of the Uighurs. In foreign policy it’s more balanced (supporting Syria vs Saudi Arabia) but even there, Russia is clearly trying to subvert foreign democracies. China is (perhaps reasonably) pushing for more power in Asia. And while the…

And you think the US isn't trying to subvert foreign democracies?

[deleted]

Re: WhatsApp voice calls were used to inject spyware on phones

#167

Post by golergka »

avip wrote: post #153
golergka wrote: post #145

Earlier quoted context omitted.

Curious as to why you think it's a bubble. Israeli startups have had many successful exits in recent years, although mostly acquisitions, and not many big flops.

It's just my unsubstantial opinion. Too many players raising too much money in a consolidated market. Bar some notable exceptions (NSO), this herd of misguided lemmings has one way out - acquisition by Checkpoint/Imperva/SalesForce. But maybe I'm wrong and we'll see 100 Mobileyes in the coming decade.

Oh, in case you meant infosec in particular, you might be right, I don't really know much about this industry.

Re: WhatsApp voice calls were used to inject spyware on phones

#169

Post by floatingatoll »

ezequiel-garzon wrote: post #160

It seems to me that if this is possible an OS software upgrade of some sort is urgently required, in addition to possible updates of WhatsApp. How come there isn’t coverage of this as Android and iOS vulnerabilities?

Gaining control of WhatsApp gains access to any API accessible to WhatsApp. Incompetent reporting may be at fault.

On Android, WhatsApp seeks a wide array of permission-controlled APIs. It does so on iOS as well. Once granted, the app has access to any data available through access-allowed APIs.

App code goes through an audit process to ensure that the app isn’t using accessible APIs inappropriately, and doesn’t permit unapproved code execution.

This vulnerability allows an attacker to execute unapproved code in the WhatsApp context. Any API that iOS or Android offer WhatsApp under normal circumstances is now attacker-controlled.

The two questions unanswered by the press to date are simple. On iOS and on Android, can the attacker’s code be terminated by force-quitting and uninstalling WhatsApp?

Either the attack is persistent only because it sets up shop inside the app, which may have OS-granted background and/or screen-off execution rights, and thus can be terminated simply by quitting and removing the app — or, the attack gains persistence beyond the confines of the app.

Media reports are unclear on this point. If the OS offers apps endpoints that an app executing attacker-controlled code can use to infect the OS with persistent attack code that executes outside the app’s boundaries and remains after app uninstallation, then that’s absolutely a flaw in the design of the OS. As you say, “Android and iOS vulnerabilities”.

Is this the case?

Re: WhatsApp voice calls were used to inject spyware on phones

#170

Post by jakobegger »

coreman wrote: post #39
bjourne wrote: post #7

All my life I've thought spyware was developed primarily by evil Russian and Chinese hackers. But apparently also by Israeli developers with their government's blessing and open endorsement. That's some very shady stuff. Before someone says something about government surveillance of fiber cables. Yes, that is also bad, but exploiting vulnerabilities to install spyware on peoples phones... It crosses yet another line…

All my life I've thought spyware was developed primarily by evil Russian and Chinese hackers. But apparently also by Israeli developers with their government's blessing and open endorsement. That's some very shady stuff. Gamma Group is an Anglo-German company that provides similar surveillance software with government blessing and endorsement. Hacking Team (Italian company) sells similar surveillance software to vari…

> Before an embarrassing data breach in 2015 they also used to sell surveillance software to various totalitarian regimes outside Europe.

Why do you think they stopped selling to those regimes? (I didn't follow the issue after it disappeared from the news)

Post reply on HN