Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WhatsApp voice calls were used to inject spyware on phones

ft.com

Post reply on HN
Print view View original

221–230 of 313 posts

Re: WhatsApp voice calls were used to inject spyware on phones

#221

Post by ak39 »

dang wrote: post #125
accountwhatever wrote: post #109

Why was the word "Israeli" removed from the title?

I took it out because the thread was veering into generic flamewar about Israel. Actually we often remove country names from titles because they trigger people into making more nationalistic comments, which are equal parts indignant and boring.

Dan, you know what would be cool for HN comments? The ability for each node of a thread to be annotated with topic names. For example, if the node close to the root node here were to be labelled "Israeli politics", I, a user interested in the technical aspects of the topic, can immediately avoid it. This feature will be a killer feature for all topics that have divergent sub-threads! (I haven't thought further than just the annotation by end user feature - so, whether it ought to be at user level or a global one ... I don't know). :-D

Re: WhatsApp voice calls were used to inject spyware on phones

#223

Post by Scoundreller »

whycomb wrote: post #177
majjam wrote: post #171

Earlier quoted context omitted.

Just updated via UK iOS app store and its 2.19.50

You're still vulnerable then. "Affected versions: ... WhatsApp for iOS prior to v2.19.51" from https://www.facebook.com/security/advisories/cve-2019-3568 The news outlets are all telling us to update, but until WhatsApp/Apple get their act together, there's no point. Worse still, people won't realise they need to do it again and will remain vulnerable indefinitely.

Lol, App Store for 2.19.51 describes the update as:

> You can now see stickers in full screen when you long press a notification

If that’s how we encourage critical security updates, I’ll suspect that Facebook themselves are behind all of this.

Re: WhatsApp voice calls were used to inject spyware on phones

#224

Post by ak39 »

caoilte wrote: post #213
floatingatoll wrote: post #169

Earlier quoted context omitted.

Gaining control of WhatsApp gains access to any API accessible to WhatsApp. Incompetent reporting may be at fault. On Android, WhatsApp seeks a wide array of permission-controlled APIs. It does so on iOS as well. Once granted, the app has access to any data available through access-allowed APIs. App code goes through an audit process to ensure that the app isn’t using accessible APIs inappropriately, and doesn’t perm…

There should be different permissions for foreground and background access to APIs.

Agreed. Or at least an admin app that lets the user see which APIs are being accessed by which app.

Re: WhatsApp voice calls were used to inject spyware on phones

#225

Post by Scoundreller »

Tepix wrote: post #211
whycomb wrote: post #168

Updated WhatsApp on my iphone just now. The version I got was 2.19.50. According to the CVE it's still vulnerable. Unable to get 2.19.51 which is the first fixed version. Is this just me? Or is everyone else updating to a still-vulnerable version?

Have you tried pulling down on the updates screen of the iOS app store? It refreshes the list of apps to be updated.

That did it. Thank you. And to think I thought I installed all of my pending updates yesterday.

Re: WhatsApp voice calls were used to inject spyware on phones

#226

Post by lm28469 »

dash2 wrote: post #132
eof wrote: post #120

Earlier quoted context omitted.

Absolutely. But no more naughty than USA or Israel, as far as I can tell.

Hmm, I don’t want to get into a state wickedness bidding war, but the US/Israel are democracies where you are unlikely to be eg locked up without a fair trial. Contrast with the fate of the Uighurs. In foreign policy it’s more balanced (supporting Syria vs Saudi Arabia) but even there, Russia is clearly trying to subvert foreign democracies. China is (perhaps reasonably) pushing for more power in Asia. And while the…

> US/Israel are democracies where you are unlikely to be eg locked up without a fair trial.

MKULTRA, guantanamo, Stuxnet, PRISM and other 3 letters agency abuses [0][1], &c. and that's only the stuff we know about.

> Then there’s the Palestinians... (sigh)

See: https://www.dw.com/en/trumps-golan-recognition-a-dangerous-p...

[0] https://en.wikipedia.org/wiki/Global_surveillance_disclosure...

[1] https://www.aclu.org/blog/national-security/privacy-and-surv...

Re: WhatsApp voice calls were used to inject spyware on phones

#227

Post by lm28469 »

bjourne wrote: post #7

All my life I've thought spyware was developed primarily by evil Russian and Chinese hackers. But apparently also by Israeli developers with their government's blessing and open endorsement. That's some very shady stuff. Before someone says something about government surveillance of fiber cables. Yes, that is also bad, but exploiting vulnerabilities to install spyware on peoples phones... It crosses yet another line…

> All my life I've thought spyware was developed primarily by evil Russian and Chinese hackers.

They're build by any government/entity having sufficient resources to build them, there is no good or bad guys in that story.

Re: WhatsApp voice calls were used to inject spyware on phones

#228

Post by thrower123 »

lm28469 wrote: post #226
dash2 wrote: post #132

Earlier quoted context omitted.

Hmm, I don’t want to get into a state wickedness bidding war, but the US/Israel are democracies where you are unlikely to be eg locked up without a fair trial. Contrast with the fate of the Uighurs. In foreign policy it’s more balanced (supporting Syria vs Saudi Arabia) but even there, Russia is clearly trying to subvert foreign democracies. China is (perhaps reasonably) pushing for more power in Asia. And while the…

> US/Israel are democracies where you are unlikely to be eg locked up without a fair trial. MKULTRA, guantanamo, Stuxnet, PRISM and other 3 letters agency abuses [0][1], &c. and that's only the stuff we know about. > Then there’s the Palestinians... (sigh) See: https://www.dw.com/en/trumps-golan-recognition-a-dangerous-p... [0] https://en.wikipedia.org/wiki/Global_surveillance_disclosure... [1] https://www.aclu.org/b…

Statistically unlikely, yes.

Grand total, you are talking about a couple thousand people over half a century.

China does worse in a month in Xinjiang. The excesses of western nations stand out like a sore asshole so badly because they are such exceptions to the general rule of law they experience.

Re: WhatsApp voice calls were used to inject spyware on phones

#229

Post by zaro »

bjourne wrote: post #7

All my life I've thought spyware was developed primarily by evil Russian and Chinese hackers. But apparently also by Israeli developers with their government's blessing and open endorsement. That's some very shady stuff. Before someone says something about government surveillance of fiber cables. Yes, that is also bad, but exploiting vulnerabilities to install spyware on peoples phones... It crosses yet another line…

>All my life I've thought spyware was developed primarily by evil Russian and Chinese hackers.

Yep, manufacturing of consent at play.

But this aside, I have a friend who worked in Israeli company whose main business was to sell phone exploits and customer data by using the still very insecure SS7. Basically they were registered as voip operator, but according to my friend that was only a cover, and the real business was selling surveillance data they were gathering via SS7.

Re: WhatsApp voice calls were used to inject spyware on phones

#230

Post by toyg »

scraegg wrote: post #183

What about Wechat? There are lots of seemingly pretty girls trying to voice or video call these days. Either I'm suddenly rich in their eyes or there's something fishy going on.

That’s the more traditional scamming/phishing, which has been going on since the days of ICQ...
Post reply on HN