WhatsApp voice calls were used to inject spyware on phones • Hacker News Board

Re: WhatsApp voice calls were used to inject spyware on phones

#271

Post by floatingatoll » Tue, May 14, 2019, 3:57 PM UTC

jmkni wrote: post #259

floatingatoll wrote: post #250

Earlier quoted context omitted.

> How could the APIs .. be abused? The app is infected, calls a 0-day using an illegal parameter that’s normally rejected by app store filters, and gains a permanent beachhead in your Android system services list. > access photos in the background Unclear. Apps can show thumbnail galleries of your photos within their native UI, so it may well be possible for them to continue directly to reading photos. > access the c…

Well I was thinking specifically about iOS :) There's no possible way to read SMS messages programatically in iOS for example, the closest you get is reading one time passwords sent, and you can only do that when the user has the keyboard open when the SMS is received. I know Android is slightly more lax in this (and some other) regards. I wonder if Android whatsapp users targeted by this exploit have had more data e…

All WhatsApp iOS users have an unpredictable set of permissions granted, whereas all WhatsApp Android users have all permissions granted.

If I were a nation state attacker, I would be thrilled to find that my target was Android.

Re: WhatsApp voice calls were used to inject spyware on phones

#272

Post by rjf72 » Tue, May 14, 2019, 4:00 PM UTC

thelittleone wrote: post #46

I guess these types of vulnerabilities could be placed intentionally. It would allow certain agencies to again access via "exploit" and all the while claim they support user privacy. These companies are under pressure from governments (like the recent Australian government law to requiring access to encrypted messages). Seems like a decent solution for company and governments.

There's also the curiously peculiar, and consistent, wording from companies that deny their involvement in programs such as PRISM [1]. As people seem to have forgotten about PRISM, NSA slides not meant for public consumption stated it enabled "extensive, in-depth surveillance on live communications and stored information" with examples including email, video and voice chat, videos, photos, voice-over-IP chats (such as Skype), file transfers, and social networking details.

But here's the fun part. Here are the corporate denials:

- Google: "We have not joined any program that would give the U.S. government direct access to our servers."

- Apple: "We do not provide any government agency with direct access to our servers."

- Facebook: "We do not provide any government organization with direct access to Facebook servers."

And so on. An exploit with plausible deniability enables these companies to make these comments completely truthfully, and at least mostly truthfully if they claim they are not providing a backdoor. But more to the point, there is absolutely no reason these companies would all say "direct access" as that's very specifically a subset of "access." If you do not facilitate direct or indirect access, why would you not simply say access? If this were a one-off thing, that'd be one thing since on occasion some PR is... odd. But literally all the companies were saying the exact same very peculiar thing. That's not a coincidence.

[1] - https://en.wikipedia.org/wiki/PRISM_%28surveillance_program%...

Re: WhatsApp voice calls were used to inject spyware on phones

#273

Post by TheSmoke » Tue, May 14, 2019, 4:15 PM UTC

is this how saudi activists were tracked or uae tapped the phones of govt officials from various countries?

Re: WhatsApp voice calls were used to inject spyware on phones

#274

Post by wil421 » Tue, May 14, 2019, 4:34 PM UTC

scraegg wrote: post #183

What about Wechat? There are lots of seemingly pretty girls trying to voice or video call these days. Either I'm suddenly rich in their eyes or there's something fishy going on.

Name a chat app and I can provide a link or comment from someone saying the same thing about pretty scam girls. Facebook, Whatspp, Gmail, Kik, Snapchat, Instagram, and even BBSes, AOL, IRC etc...

Re: WhatsApp voice calls were used to inject spyware on phones

#275

Post by wil421 » Tue, May 14, 2019, 4:55 PM UTC

StanislavPetrov wrote: post #155

dash2 wrote: post #134

Earlier quoted context omitted.

[flagged]

The US has killed millions of people in the last 15 years alone in Iraq, Afghanistan, Libya, Syria, Yemen and a dozen other countries that we have bombed or invaded (including the 8 we are bombing right now). I'm under no illusions about the many despicable things done by the Russians and the Chinese, but its simply absurd to contend that their behavior has any worse than the United States. We have more of our citize…

The US has not killed millions of people in the last 15 years that is just a blatantly false statement. A quick search on Google or Wikipedia will refute your claim instantly.

Can you provide a decent source for your millions of casualties claim or for you claim about the US toppling more Governments than Russia/China? I bet you can’t.

Judging by your username I believe you know some things about history. Why spread false info?

Re: WhatsApp voice calls were used to inject spyware on phones

#276

Post by dang » Tue, May 14, 2019, 5:12 PM UTC

anonymousDan wrote: post #190

dang wrote: post #125

Earlier quoted context omitted.

I took it out because the thread was veering into generic flamewar about Israel. Actually we often remove country names from titles because they trigger people into making more nationalistic comments, which are equal parts indignant and boring.

That's a bit of a pathetic policy if you ask me. In my opinion a country who permits this type of behaviour shouldn't be shielded from the ensuing negative press. If anything it might encourage otherwise unaware citizens to put pressure on the government to do something about it.

I hear you. I agree with your second sentence. But I'm trying to protect HN, not Israel or anyone else. This place is fragile, and when people bring the fires of the world here, it can only take so much.

I wouldn't call that kind of title edit (taking out a country name) a policy. We have an ad hoc bag of tricks and sometimes we use one and sometimes another, depending on what feels needed. Do I know how unsatisfying that sounds? You bet. Do I get how it opens us to accusations of bias? I do, better than anyone else does. But the threads are too complicated to be managed with precise formalizations.

Re: WhatsApp voice calls were used to inject spyware on phones

#277

Post by dang » Tue, May 14, 2019, 5:15 PM UTC

bjourne wrote: post #241

dang wrote: post #126

Earlier quoted context omitted.

Sure, we take out the baity parts of titles because they produce lousier discussion. This is standard HN moderation: https://news.ycombinator.com/newsguidelines.html . See https://news.ycombinator.com/item?id=19906729 for more explanation.

Cursory Google searches seem to indicate that the same policy isn't applied for Chinese or Russian cyber threats. You also didn't remove the country name in other recent news, despite the production of even lousier discussion: https://news.ycombinator.com/item?id=19638357 https://news.ycombinator.com/item?id=19634570 The moderation is inconsistent.

I'm not claiming consistency. For one thing, we don't come close to seeing everything that gets posted here. If you see a particularly bad post get away without moderation, the likeliest explanation is that we didn't see it. We can't be consistent about what we don't see.

There are a ton of other considerations, though, and it gets complicated quickly. I'm always happy to discuss specific cases, but general arguments are another matter. Sometimes it feels like people want us to make general arguments so they can find exceptions and then say things like "aha" and "your obvious bias" and "figures". But we don't have general policies about such complicated things. We have basic principles and that's it: https://news.ycombinator.com/newsguidelines.html.

If you don't think we've been trying to reduce nationalistic flamewar about China and Russia, you could try looking at HN threads on those topics. I don't know anything I've been working at harder lately. On the other hand, there are many more of those, especially on China, so cf. the first paragraph above.

https://hn.algolia.com/?sort=byDate&dateRange=all&type=comme...

Re: WhatsApp voice calls were used to inject spyware on phones

#278

Post by Udik » Tue, May 14, 2019, 5:19 PM UTC

vxNsr wrote: post #266

Udik wrote: post #200

Earlier quoted context omitted.

> ...they’re going to hold a press conference and say “It wasn’t us” as they wear t-shirts that say “IT WAS DEFINITELY US,” and then they’re going to buy all of your stuff at your estate sale so that they can directly look at the photos of your vacation instead of reading your insipid emails about them. That's basically Israel's attitude on anything: doing anything they want without any kind of boundaries, then denyi…

> Like having snipers shooting at thousands of civilians, kids, journalists, paramedics, who are protesting inside their own borders. Ugh... this is so myopic and sounds like you're intentionally not telling the truth. all those "kids", "journalists", and "paramedics" were shown to be carrying bombs or other explosives.

Hm. All six thousand of them? Kids? Paramedics? Journalists? Do you have any sources for that?

Re: WhatsApp voice calls were used to inject spyware on phones

#279

Post by toomanyrichies » Tue, May 14, 2019, 5:49 PM UTC

avip wrote: post #153

golergka wrote: post #145

Earlier quoted context omitted.

Curious as to why you think it's a bubble. Israeli startups have had many successful exits in recent years, although mostly acquisitions, and not many big flops.

It's just my unsubstantial opinion. Too many players raising too much money in a consolidated market. Bar some notable exceptions (NSO), this herd of misguided lemmings has one way out - acquisition by Checkpoint/Imperva/SalesForce. But maybe I'm wrong and we'll see 100 Mobileyes in the coming decade.

At the risk of being pedantic- did you by chance mean "unsubstantiated"? :-)

unsubstantiated (adj)- not supported or proven by evidence.

unsubstantial (adj)- lacking material substance

Re: WhatsApp voice calls were used to inject spyware on phones

#280

Post by sangnoir » Tue, May 14, 2019, 5:49 PM UTC

dash2 wrote: post #134

StanislavPetrov wrote: post #48

Earlier quoted context omitted.

>All my life I've thought spyware was developed primarily by evil Russian and Chinese hackers. You've led a very sheltered life if you think the Russians and the Chinese have been more evil than the Americans or the Israelis. I suggest reading history - a lot of it. When it comes to governments there are no good guys, only bad guys.

[flagged]

Roosevelt personally? No. America as a whole? Yes, comparisons can absolutely be made between America's and Hitler's genocidal philosophies, as the former influenced the latter[1].

1. https://www.newyorker.com/magazine/2018/04/30/how-american-r...