Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

US has investigated claims WhatsApp chats aren't private

bloomberg.com

Post reply on HN
Print view View original

251–260 of 387 posts

Re: US has investigated claims WhatsApp chats aren't private

#251

Post by TZubiri »

oofbey wrote: post #236
TZubiri wrote: post #231

Earlier quoted context omitted.

With all due respect to Stallman, you can actually study binaries. The claim Stallman would make (after punishing you for using Open Source instead of Free Software for an hour) is that Closed Software (Proprietary Software) is unjust. but in the context of security, the claim would be limited to Free Software being capable of being secure too. You may be able to argue that Open Source reduces risk in threat models w…

What’s the state of the art of reverse engineering source code from binaries in the age of agentic coding? Seems like something agents should be pretty good at, but haven’t read anything about it.

Nothing yet, agents analyze code which is textual.

The way they analyze binaries now is by using textual interfaces of command tools, and the tools used are mostly the ones supported by Foundation Models at training time, mostly you can't teach it new tools at inference, they must be supported at training. So most providers are focused on the same tools and benchmarking against them, and binary analysis is not in the zeitgeist right now, it's about production more than understanding.

Re: US has investigated claims WhatsApp chats aren't private

#252

Post by roughly »

oofbey wrote: post #236
TZubiri wrote: post #231

Earlier quoted context omitted.

With all due respect to Stallman, you can actually study binaries. The claim Stallman would make (after punishing you for using Open Source instead of Free Software for an hour) is that Closed Software (Proprietary Software) is unjust. but in the context of security, the claim would be limited to Free Software being capable of being secure too. You may be able to argue that Open Source reduces risk in threat models w…

What’s the state of the art of reverse engineering source code from binaries in the age of agentic coding? Seems like something agents should be pretty good at, but haven’t read anything about it.

I think there’s a good possibility that the technology that is LLMs could be usefully trained to decode binaries as a sort of squint-and-you-can-see-it translation problem, but I can’t imagine, eg, pre-trained GPT being particularly good at it.

Re: US has investigated claims WhatsApp chats aren't private

#253

Post by impure-aqua »

subw00f wrote: post #224
maqp wrote: post #213

Earlier quoted context omitted.

Well the thing is, the key exfiltration code would probably reside outside the TCB. Not particularly hard to have some function grab the signing keys, and send them to the server. Then you can impersonate as the user in MITM. That exfiltration is one-time and it's quite hard to recover from. I'd much rather not have blind faith on WhatsApp doing the right thing, and instead just use Signal so I can verify myself it's…

Not that I trust Facebook or anything but wouldn’t a motivated investigator be able to find this key exfiltration “function” or code by now? Unless there is some remote code execution flow going on.

WhatsApp performs dynamic code loading from memory, GrapheneOS detects it when you open the app, and blocking this causes the app to crash during startup. So we know that static analysis of the APK is not giving us the whole picture of what actually executes.

This DCL could be fetching some forward_to_NSA() function from a server and registering it to be called on every outgoing message. It would be trivial to hide in tcpdumps, best approach would be tracing with Frida and looking at syscalls to attempt to isolate what is actually being loaded, but it is also trivial for apps to detect they are being debugged and conditionally avoid loading the incriminating code in this instance. This code would only run in environments where the interested parties are sure there is no chance of detection, which is enough of the endpoints that even if you personally can set off the anti-tracing conditions without falling foul of whatever attestation Meta likely have going on, everyone you text will be participating unknowingly in the dragnet anyway.

Re: US has investigated claims WhatsApp chats aren't private

#255

Post by jcgl »

maqp wrote: post #213
Barrin92 wrote: post #209

Earlier quoted context omitted.

as long as client side encryption has been audited, which to my understanding is the case, it doesn't matter. That is literally the point of encryption, communication across adversarial channels . Unless you think Facebook has broken the laws of mathematics it's impossible for them to decrypt the content of messages without the users private keys.

Well the thing is, the key exfiltration code would probably reside outside the TCB. Not particularly hard to have some function grab the signing keys, and send them to the server. Then you can impersonate as the user in MITM. That exfiltration is one-time and it's quite hard to recover from. I'd much rather not have blind faith on WhatsApp doing the right thing, and instead just use Signal so I can verify myself it's…

> That exfiltration is one-time and it's quite hard to recover from.

Not quite true with Signal's double ratchet though, right? Because keys are routinely getting rolled, you have to continuously exfiltrate the new keys.

Re: US has investigated claims WhatsApp chats aren't private

#256

Post by uoaei »

martinralbrecht wrote: post #126

WhatsApp's end-to-end encryption has been independently investigated: https://kclpure.kcl.ac.uk/ws/files/324396471/whatsapp.pdf Full version here: https://eprint.iacr.org/2025/794.pdf We didn't review the entire source code, only the cryptographic core. That said, the main issue we found was that the WhatsApp servers ultimately decide who is and isn't in a particular chat. Dan Goodin wrote about it here: https://arst…

Can they control private keys and do replay attacks?

Re: US has investigated claims WhatsApp chats aren't private

#257

Post by objclxt »

TZubiri wrote: post #231
coppsilgold wrote: post #227

No closed-source E2EE client can be truly secure because the ends of e2e are opaque. Detecting backdoors is only truly feasible with open source software and even then it can difficult. A backdoor can be a subtle remote code execution "vulnerability" that can only be exploited by the server. If used carefully and it exfiltrates data in expected client-server communications it can be all but impossible to detect. This…

With all due respect to Stallman, you can actually study binaries. The claim Stallman would make (after punishing you for using Open Source instead of Free Software for an hour) is that Closed Software (Proprietary Software) is unjust. but in the context of security, the claim would be limited to Free Software being capable of being secure too. You may be able to argue that Open Source reduces risk in threat models w…

> in any other threat model, security is an advantage of closed source

I think there's a lot of historical evidence that doesn't support this position. For instance, Internet Explorer was generally agreed by all to be a much weaker product from a security perspective than its open source competitors (Gecko, WebKit, etc).

Nobody was defending IE from a security perspective because it was closed source.

Re: US has investigated claims WhatsApp chats aren't private

#258

Post by Arch-TK »

singpolyma3 wrote: post #249
TZubiri wrote: post #231

Earlier quoted context omitted.

With all due respect to Stallman, you can actually study binaries. The claim Stallman would make (after punishing you for using Open Source instead of Free Software for an hour) is that Closed Software (Proprietary Software) is unjust. but in the context of security, the claim would be limited to Free Software being capable of being secure too. You may be able to argue that Open Source reduces risk in threat models w…

I was with you until you somehow claimed obfuscation can improve security, against all historical evidence even pre-computers.

Obscurity is a delay tactic which raises the time cost associated with an attack. It is true that obscurity is not a security feature, but it is also true that increasing the time cost associated with attacking you is a form of deterrant from attempts. If you are not at the same time also secure in the conventional sense then it is only buying you time until someone puts in the effort to figure out what you are doing and own you. And you better have a plan for when that time comes. But everyone needs time, because bugs happen, and you need that time to fix them before they are exploited.

The difference between obscurity and a secret (password, key, etc) is the difference between less then a year to figure it out and a year or more to figure it out.

There is a surprising amount of software out there with obscurity preventing some kind of "abuse" and in my experience these features are not that strong, but it takes someone like me hours to reverse engineer these things, and in many cases I am the first person to do that after years of nobody else bothering.

Re: US has investigated claims WhatsApp chats aren't private

#259

Post by tptacek »

TZubiri wrote: post #231
coppsilgold wrote: post #227

No closed-source E2EE client can be truly secure because the ends of e2e are opaque. Detecting backdoors is only truly feasible with open source software and even then it can difficult. A backdoor can be a subtle remote code execution "vulnerability" that can only be exploited by the server. If used carefully and it exfiltrates data in expected client-server communications it can be all but impossible to detect. This…

With all due respect to Stallman, you can actually study binaries. The claim Stallman would make (after punishing you for using Open Source instead of Free Software for an hour) is that Closed Software (Proprietary Software) is unjust. but in the context of security, the claim would be limited to Free Software being capable of being secure too. You may be able to argue that Open Source reduces risk in threat models w…

It's weird to me that it's 2026 and this is still a controversial argument. Deep, tricky memory corruption exploit development is done on closed-source targets, routinely, and the kind of backdoor/bugdoor people conjure in threads about E2EE are much simpler than those bugs.

It was a pretty much settled argument 10 years ago, even before the era of LLVM lifters, but post-LLM the standard of care practice is often full recompilation and execution.

Re: US has investigated claims WhatsApp chats aren't private

#260

Post by tptacek »

refulgentis wrote: post #243
JasonADrury wrote: post #237

Earlier quoted context omitted.

>Expalin how you detect a branched/flaged sendKey (or whatever it would be called) call in the compiled WhatsApp iOS app? Vastly easier than spotting a clever bugdoor in the source code of said app.

Putting it all on the table: do you agree with the claim that binary analysis is just as good as source code analysis?

I don't agree with "vastly better" but its arguable both in the direction and magnitude. I don't think you could plausibly argue that binary analysis is "vastly harder".
Post reply on HN