US has investigated claims WhatsApp chats aren't private

Post by maqp » Sat, Jan 31, 2026, 10:08 PM UTC

impure-aqua wrote: post #253

subw00f wrote: post #224

Earlier quoted context omitted.

Not that I trust Facebook or anything but wouldn’t a motivated investigator be able to find this key exfiltration “function” or code by now? Unless there is some remote code execution flow going on.

WhatsApp performs dynamic code loading from memory, GrapheneOS detects it when you open the app, and blocking this causes the app to crash during startup. So we know that static analysis of the APK is not giving us the whole picture of what actually executes. This DCL could be fetching some forward_to_NSA() function from a server and registering it to be called on every outgoing message. It would be trivial to hide i…

Post by oofbey » Sat, Jan 31, 2026, 10:11 PM UTC

TZubiri wrote: post #251

oofbey wrote: post #236

Earlier quoted context omitted.

What’s the state of the art of reverse engineering source code from binaries in the age of agentic coding? Seems like something agents should be pretty good at, but haven’t read anything about it.

Nothing yet, agents analyze code which is textual. The way they analyze binaries now is by using textual interfaces of command tools, and the tools used are mostly the ones supported by Foundation Models at training time, mostly you can't teach it new tools at inference, they must be supported at training. So most providers are focused on the same tools and benchmarking against them, and binary analysis is not in the…

Post by oofbey » Sat, Jan 31, 2026, 10:13 PM UTC

refulgentis wrote: post #239

oofbey wrote: post #236

Earlier quoted context omitted.

What’s the state of the art of reverse engineering source code from binaries in the age of agentic coding? Seems like something agents should be pretty good at, but haven’t read anything about it.

Agents are sort of irrelevant to this discussion, no? Like, it's assuredly harder for an agent than having access to the code, if only because there's a theoratical opportunity to misunderstand the decompile. Alternatively, it's assuredly easier for an agent because given execution time approaches infinity, they can try all possible interpretations.

Post by cookiengineer » Sat, Jan 31, 2026, 10:17 PM UTC

tptacek wrote: post #219

cookiengineer wrote: post #217

Earlier quoted context omitted.

Why did you not mention that the WhatsApp apk, even on non-google play installed devices, loads google tag manager's scripts? It is reproducibly loaded in each chat, and an MitM firewall can also confirm that. I don't know why the focus of audits like these are always on a specific part of the app or only about the cryptography parts, and not the overall behavior of what is leaked and transferred over the wire, and n…

There's a whole section, early, in the analysis Albrecht posted that surfaces these concerns.

Post by maqp » Sat, Jan 31, 2026, 10:21 PM UTC

Retr0id wrote: post #12

londons_explore wrote: post #8

I want whatsapp to decrypt the messages in a secure enclave and render the message content to the screen with a secure rendering pipeline, as is done with DRM'ed video. Compromise of the client side application or OS shouldn't break the security model. This should be possible with current API's, since each message could if needed simply be a single frame DRM'ed video if no better approach exists (or until a better ap…

Signal uses the DRM APIs to mitigate threats like Microsoft Recall, but it doesn't stop the app itself from reading its own data. I don't really see how it's possible to mitigate client compromise. You can decrypt stuff on a secure enclave but at some point the client has to pull it out and render it.