Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WhatsApp backdoor allows snooping on encrypted messages

theguardian.com

Post reply on HN
Print view View original

301–310 of 334 posts

Re: WhatsApp backdoor allows snooping on encrypted messages

#301

Post by conradev »

Crosseye_Jack wrote: post #237
clort wrote: post #225

Earlier quoted context omitted.

how does that help, I think tor can be blocked..?

The GFW is able to recognise Tor usage. > The firewall searches for a bunch of bytes which identify a network connection as Tor. If these bytes are found the firewall initiates a scan of the host which is believed to be a bridge. In particular the scan is run by seemingly arbitrary Chinese computers which connect to the bridge and try to “speak Tor” to it. If this succeeds, the bridge is blocked. http://www.cs.kau.se…

That same person developed ScrambleSuit[1], which is used as a pluggable transport to obfuscate traffic and prevent detection/active probing. Work is continuing to keep the GFW from being able to catch up [2][3].

[1] http://www.cs.kau.se/philwint/scramblesuit/

[2] https://github.com/Yawning/obfs4

[3] https://git.schwanenlied.me/yawning/basket2

Re: WhatsApp backdoor allows snooping on encrypted messages

#303

Post by sofaofthedamned »

Crosseye_Jack wrote: post #222
EGreg wrote: post #190

Earlier quoted context omitted.

Can you make an unblockable app?

No, but blocking it could piss off a large part of your population. It all depends on how far you are willing to push the blocking and how much you are willing to disable so you can block anything. Signal atm are using domain fronting. (iirc the app will soon test the network conditions before attempting to use domain fronting, but for now it checks the country code of your phone number) It will open a HTTPS connecti…

Nice description there. Google may not be pleased by this and be under pressure to revoke their access, but eventually they will make it clear that this shit doesn't fly. Nice workaround.

Re: WhatsApp backdoor allows snooping on encrypted messages

#304

Post by IvarTheHomeless »

niksakl wrote: post #47

Well, I kind of feel that I have to repost my comment on this old thread[1] with regards to the government of Egypt blocking Signal application: "Isn't it "weird" that they chose to block Signal app and not the signal-protocol based Whatsapp? If Whatsapp really implements the same kind of security and privacy measures that Signal does, why is Whatsapp allowed to continue operating? If signal is preventing them spy on…

There was a different commenter, possibly in a different HN thread, who was explaining that as an Egyptian resident he thought the government was blocking things like Whatsapp and Signal to protect one of the non government employers in Egypt, the telecommunications industry, which makes money from charging for phone calls and sms messages.

Re: WhatsApp backdoor allows snooping on encrypted messages

#305

Post by ycmbntrthrwaway »

> Boelter said: “[Some] might say that this vulnerability could only be abused to snoop on ‘single’ targeted messages, not entire conversations. This is not true if you consider that the WhatsApp server can just forward messages without sending the ‘message was received by recipient’ notification (or the double tick), which users might not notice. Using the retransmission vulnerability, the WhatsApp server can then later get a transcript of the whole conversation, not just a single message.”

Actually it is not that easy. Signal protocol [0] does not have any inherent delivery notification, but it is implemented in the application [1]. If attacker wants to deliver messages two-way without delivering receipts, it has to recognize them somehow. Of course you can try to guess by not delivering the first message after each delivery, but it seems too unreliable for a backdoor.

[0] https://whispersystems.org/docs/specifications/doubleratchet...

[1] https://support.whispersystems.org/hc/en-us/articles/2125355...

Re: WhatsApp backdoor allows snooping on encrypted messages

#306

Post by xorcist »

afshinmeh wrote: post #229
admax88q wrote: post #136

Earlier quoted context omitted.

I wouldn't trust whatsapp even before this revelation. I would never trust a closed source messaging app if I was an activist, regardless of what encryption they claim to implement.

Good point. At least as a technical person, I would like to use an open-source messaging application. Of course I'm not going to read the source code but at least I'm sure developers behind the app do not open a backdoor for someone else.

The mobile space is tricky. A source code dump doesn't really do much beyond "trust us, this is what you get from App Store too". You also need the possibility to build the software yourself, which include things like API keys, before we're close to what assurances open source software used to give us.

Re: WhatsApp backdoor allows snooping on encrypted messages

#307

Post by ycmbntrthrwaway »

belovedeagle wrote: post #232
disgusting_guy wrote: post #198

Earlier quoted context omitted.

No, all messages cannot be recovered by Facebook. Read the article - messages that are not yet delivered can potentially be read; if it has been delivered it cannot be retrieved.

You go read the article. The deciding factor is not whether the message has been delivered, but whether WhatsApp servers report to the device that the message has been delivered. There's nothing stopping them from claiming that no messages have been delivered and thus recovering all messages (as long as they had been preselected for false delivery reports) despite true delivery status.

> but whether WhatsApp servers report to the device that the message has been delivered

It is hard to check what WhatsApp does, but in Signal it is not the server, but a recipient who sends delivery receipt. WhatsApp then has to either recognize encrypted receipts or allow only one-way conversation during attack. Carrying out the whole attack just to decrypt "hi, are you here?" is not really interesting.

Re: WhatsApp backdoor allows snooping on encrypted messages

#308

Post by ycmbntrthrwaway »

Jarwain wrote: post #277
belovedeagle wrote: post #232

Earlier quoted context omitted.

You go read the article. The deciding factor is not whether the message has been delivered, but whether WhatsApp servers report to the device that the message has been delivered. There's nothing stopping them from claiming that no messages have been delivered and thus recovering all messages (as long as they had been preselected for false delivery reports) despite true delivery status.

So they can recover the messages, right? However, wouldn't these messages still be encrypted? Sure, they force a key change, and the messages are encrypted using the new key and sent. Theoretically, an attacker could have multiple copies of the same message, but these messages would still be encrypted under a variety of different keys right? Wouldn't the content of the messages still be secure? Unless the key-change…

New encryption (public) key is selected by the attacker, so he knows the decryption (private) key. Basically attacker just puts real device offline and registers his own device.

Re: WhatsApp backdoor allows snooping on encrypted messages

#309

Post by derefr »

xorcist wrote: post #306
afshinmeh wrote: post #229

Earlier quoted context omitted.

Good point. At least as a technical person, I would like to use an open-source messaging application. Of course I'm not going to read the source code but at least I'm sure developers behind the app do not open a backdoor for someone else.

The mobile space is tricky. A source code dump doesn't really do much beyond "trust us, this is what you get from App Store too". You also need the possibility to build the software yourself, which include things like API keys, before we're close to what assurances open source software used to give us.

The nice thing about a FOSS mobile app is that you can (in theory, at least) sideload it. A covert operation could just gather up everyone's devices, build a fresh copy of the app, and then sideload that copy for everybody.

Of course, for that to be feasible, the network architecture of the app must not require API keys—and so must either be purely peer-to-peer, or involve a FOSS server component that the developer can run an instance of themselves (as in the Matrix protocol.)

Re: WhatsApp backdoor allows snooping on encrypted messages

#310

Post by ameister14 »

swegg wrote: post #289
jyrkesh wrote: post #261

Earlier quoted context omitted.

Yeah, but that's not how the exploit would work. If you read the article, the "backdoor" is that WhatsApp could "generate" a new private key without your knowledge. Except that instead of generating a key, they'd use a well-known key. From there, they could give that key to state actors, or they could decrypt the traffic themselves and give it to state actors. Either way, you need server side control of WhatsApp.

Which you could get by hacking WhatsApp endpoints.

Is there any evidence that this happened?
Post reply on HN