Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NSO hacked WhatsApp to spy on top government officials at U.S. allies

reuters.com

Post reply on HN
Print view View original

241–250 of 321 posts

Re: NSO hacked WhatsApp to spy on top government officials at U.S. allies

#241

Post by qtplatypus »

d47gktid wrote: post #14

This seems like a disinformation campaign aimed at diverting attention from the fact that the governments of the human rights activists, human rights lawyers themselves used pegasus from NSO to target them. Many of the Indian activists, journalists, lawyers who were targeted are working for low caste victims of false cases filed against them. John from Citizen Lab personally called them and told 'Your government atta…

How is this disinformation? The story says that NSO was used to target human rights advocates.

Re: NSO hacked WhatsApp to spy on top government officials at U.S. allies

#242

Post by frabbit »

rodgerd wrote: post #166
blotter_paper wrote: post #27

Earlier quoted context omitted.

I mean, Signal is open source and not owned by Facebook, so I'm not sure why anybody uses WhatsApp instead.

The Signal client is open source. The back end not so much. A lot of Signal is basically "trust Moxie".

And most of that is coming from MattGreen and Ptacek.

Re: NSO hacked WhatsApp to spy on top government officials at U.S. allies

#243

Post by frabbit »

skybrian wrote: post #116
vocatus_gate wrote: post #35

Earlier quoted context omitted.

WhatsApp allegedly uses an implementation of the OpenWhisper encryption system that Signal created (and still uses). However as there is no source code available unlike Signal, there's no way to verify if WhatsApp "really" is using it (or using it correctly).

It's certainly better to have source, but this seems like a matter of degree? You don't really know what's in Signal unless you compile it yourself, and/or they have reproducible builds and you verify checksums. Instead you're trusting that the source matches the binary, and probably also that someone else who knows more about crypto is reviewing the source carefully. In the modern world we basically outsource everyt…

But it's _so_ much better than GPG and the WoT where you have to ... verify..... everything........... yourself...........

Re: NSO hacked WhatsApp to spy on top government officials at U.S. allies

#244

Post by syntheticcorp »

fauigerzigerk wrote: post #109
vocatus_gate wrote: post #35

Earlier quoted context omitted.

WhatsApp allegedly uses an implementation of the OpenWhisper encryption system that Signal created (and still uses). However as there is no source code available unlike Signal, there's no way to verify if WhatsApp "really" is using it (or using it correctly).

Is there a way to verify that the Signal app in the app store was compiled from the published Signal sources?

Yes, this is generally called "reproducible builds". Signal has reproducible builds for Android, here is how to build it and compare against the one on your phone:

https://github.com/signalapp/Signal-Android/blob/master/Repr...

Re: NSO hacked WhatsApp to spy on top government officials at U.S. allies

#245

Post by eru »

heavenlyblue wrote: post #193
fouric wrote: post #173

Earlier quoted context omitted.

Hypocritical? How many of your personal secrets (or even your corporate secrets) would cause >= thousands of people to die or >= billions of taxpayer dollars to be lost if they were leaked?

Suppose I am a pedophile and somebody discovers that. They then use that as a leverage against me to perform something entirely else, which is illegal, too. In the context of our society, me being a pedophile is better than me being a pedophile who also does other illegal things to cover that up.

That's only true after the fact.

Up front the prospect of even greater damage might deter people.

Similar to how punishing wrong-doers in general doesn't help anyone after the fact, but one justification people bring up is deterrence before the fact.

(I profess no firm opinion in the matter. This is just giving the argument a steelmanning.)

Re: NSO hacked WhatsApp to spy on top government officials at U.S. allies

#246

Post by eru »

inglor wrote: post #201
milofeynman wrote: post #9

The article doesn't really say what hackers had access to, but it sounds like they had full control over their phones. There is a lot bigger story here and I'd love to read a post-mortem in a few months. Also, WhatsApp is such an obvious target for a state actor. I saw several articles of the last year that mentioned Jared Kushner using Whatsapp so I assume a lot of government folks use it for off the books "encrypte…

NSO still have multiple ubpatched 0 days in WhatsApp Telegram and most other messaging apps. Your best bet is to use something obscure so you cannot easily be targeted or not being connected to the same net. At the Israeli army we had phones that ran completely separate software stacks and talked to a different network for this. Nothing was on the internet.

Security by using obscure software has its own problems, alas.

You have less eyeballs looking for exploits on the good guys side as well. So problems stay open.

Re: NSO hacked WhatsApp to spy on top government officials at U.S. allies

#247

Post by eitland »

rodgerd wrote: post #166
blotter_paper wrote: post #27

Earlier quoted context omitted.

I mean, Signal is open source and not owned by Facebook, so I'm not sure why anybody uses WhatsApp instead.

The Signal client is open source. The back end not so much. A lot of Signal is basically "trust Moxie".

> A lot of Signal is basically "trust Moxie".

Let me come out and defend Signal (I usually defend Telegram, but I don't think we should be unfair to anyone):

As far as I am aware no one who knows what they are talking about has come out with anything that says Signals end-to-end encryption is broken.

If I have understood it correctly an as long as that is true, NSA, FSB and the Chinese might be running the message handling together and there's still no reason to be worried that your messages will be intercepted in transit.

Disclaimer:

- as far as I am aware Signal is the safest messenger available for everyone

- even if all the above is true you are still trusting them with your metadata. I think they are good people. If you are scared of them, be aware that they know who you talk to and when. This is however true for any mainstream technology as far as I am aware.

- being good at crypto doesn't make them immune to bugs. There was a nasty vulnerability a few months ago that was remotely exploitable. Again, this is the same, or even worse for every other messenger.

Re: NSO hacked WhatsApp to spy on top government officials at U.S. allies

#248

Post by jacobwilliamroy »

jonplackett wrote: post #104

What are Israel doing to get so good at this and chip design and weapons making and everything else they seem to be really good at? There’s only about 8 million people in the whole country. There are plenty of cities with more people than that. How come they punch so far above their weight?

Israel is beset on all sides by enemies of its state and has basically been at war since its creation. It has a very strong incentive to develop military industries. With support from the international community, they also have had the means to do so.

Re: NSO hacked WhatsApp to spy on top government officials at U.S. allies

#249

Post by jacobwilliamroy »

inglor wrote: post #201
milofeynman wrote: post #9

The article doesn't really say what hackers had access to, but it sounds like they had full control over their phones. There is a lot bigger story here and I'd love to read a post-mortem in a few months. Also, WhatsApp is such an obvious target for a state actor. I saw several articles of the last year that mentioned Jared Kushner using Whatsapp so I assume a lot of government folks use it for off the books "encrypte…

NSO still have multiple ubpatched 0 days in WhatsApp Telegram and most other messaging apps. Your best bet is to use something obscure so you cannot easily be targeted or not being connected to the same net. At the Israeli army we had phones that ran completely separate software stacks and talked to a different network for this. Nothing was on the internet.

That sounds pretty cool. Did you all have your own separate physical layer just for military too, or did you use the same physical layer as the civilian world?

Re: NSO hacked WhatsApp to spy on top government officials at U.S. allies

#250

Post by sergiomattei »

rshnotsecure wrote: post #63
ChuckMcM wrote: post #51

Earlier quoted context omitted.

So you're saying "typical intelligence analyst stuff" is the reasoning here? Generally analysts produce questions which operations runs down to figure out if what they think is going on, is actually going on. Correct me if I'm wrong here but you're basically saying that you have done the first part and found some suspicious links but not the second part do develop actual evidence one way or the other, is that a fair…

I am writing this all on a phone and I am more than happy to produce a 5000 word report which will be posted in 96 hours. I will follow up via a comment here and also send to Michael Forsythe at the New York Times for additional review. You have my word. EDIT: 5000 words not pages

I'm very interested. Commenting as reminder to check this later.
Post reply on HN