WhatsApp Security Vulnerability
schneier.com
WhatsApp Security Vulnerability
1–10 of 71 posts
Re: WhatsApp Security Vulnerability
#2I didn't quite grasp why attacking entity (e.g. government) has the ability to read messages.
What does "WhatsApp has the ability to force the generation of new encryption keys for offline users" mean? Does it mean that WhatsApp backend has the ability to force sender to use pregenerated compromised key provided by attacker?
In terms of WhatsApp security whitepaper, does that mean that attacker can force sender to use newly generated (by attacker) S_recipient, O_recipient and the main one, I_recipient?
I'm asking because "force the generation of new _encryption_ keys" doesn't really specify who would generate keys, or what about identity key that signs everything.
Re: WhatsApp Security Vulnerability
#3Even if they changed this specific design decision/vulnerability, it seems like there's a big gaping hole (or I'm missing something).
Given that WhatsApp brokers the initial key exchange, lawful interdiction can take place at WhatsApp under subpoena. What we hope is the case is that WhatsApp would fight these orders in court, claiming that the keys are merely forwarded and aren't stored by design. But if they fought and lost, then presumably they'd comply with the orders and the provision not to reveal the order. Do we really think that WhatsApp and/or Facebook have the conviction of Ladar Levison?
It would seem that all new accounts created at WhatsApp after that theoretical warrant is executed are at risk.
Re: WhatsApp Security Vulnerability
#4Even if they changed this specific design decision/vulnerability, it seems like there's a big gaping hole (or I'm missing something). Given that WhatsApp brokers the initial key exchange, lawful interdiction can take place at WhatsApp under subpoena. What we hope is the case is that WhatsApp would fight these orders in court, claiming that the keys are merely forwarded and aren't stored by design. But if they fought…
I'd assume the keys are generated on device.
Re: WhatsApp Security Vulnerability
#5The article mostly just quotes two other sources that have already been discussed here:
WhatsApp backdoor allows snooping on encrypted messages, https://news.ycombinator.com/item?id=13389935
There is no WhatsApp 'backdoor', https://news.ycombinator.com/item?id=13394900
Re: WhatsApp Security Vulnerability
#6Even if they changed this specific design decision/vulnerability, it seems like there's a big gaping hole (or I'm missing something). Given that WhatsApp brokers the initial key exchange, lawful interdiction can take place at WhatsApp under subpoena. What we hope is the case is that WhatsApp would fight these orders in court, claiming that the keys are merely forwarded and aren't stored by design. But if they fought…
I'd assume the keys are generated on device.
They are, so I'm not sure I understand the attack upthread.
Re: WhatsApp Security Vulnerability
#7I didn't quite grasp why attacking entity (e.g. government) has the ability to read messages. What does "WhatsApp has the ability to force the generation of new encryption keys for offline users" mean? Does it mean that WhatsApp backend has the ability to force sender to use pregenerated compromised key provided by attacker? In terms of WhatsApp security whitepaper, does that mean that attacker can force sender to us…
WhatsApp has the ability to change the identity key associated with a user. That's the key they give anyone who wishes to send a message to that user. This is necessary in case the device is lost, wiped or replaced. Changing the identity key triggers a notification for other parties in a conversation if they have enabled that option. However, WhatsApp also automatically re-encrypts any messages that have not been marked as delivered using the new identity key. An attacker that could force WhatsApp to change the identity key to one under their control could then read those re-encrypted messages, but not any messages that were already marked as delivered (or any future messages, assuming the notification causes the chat parties to re-verify the keys out of band before continuing their conversation).
Re: WhatsApp Security Vulnerability
#8The article mostly just quotes two other sources that have already been discussed here: WhatsApp backdoor allows snooping on encrypted messages , https://news.ycombinator.com/item?id=13389935 There is no WhatsApp 'backdoor' , https://news.ycombinator.com/item?id=13394900
Yep, this is an analysis by a trusted individual in the security field. His ultimate summary:
> [WhatsApp's representative is] technically correct. This is not a backdoor. This really isn't even a flaw. It's a design decision that put usability ahead of security in this particular instance.
Re: WhatsApp Security Vulnerability
#9Earlier quoted context omitted.
I'd assume the keys are generated on device.
They are, so I'm not sure I understand the attack upthread.
A plausible attack scenario, outlined in multiple steps:
1) Police arrest a drug dealer, who manages to turn his phone off by smashing it on the floor and the battery pops out, in the same step also locking the data from readout if the device is using FDE
2) Cops now take the SIM card, compel the provider to provide the PUK to unlock the SIM card and insert it into their own smartphone
3) Cops activate WhatsApp and now can read any messages sent after the arrest, thus discovering potential clients. They can also impersonate the drug dealer and arrange sting operations.
Re: WhatsApp Security Vulnerability
#10Earlier quoted context omitted.
They are, so I'm not sure I understand the attack upthread.
A plausible attack scenario, outlined in multiple steps: 1) Police arrest a drug dealer, who manages to turn his phone off by smashing it on the floor and the battery pops out, in the same step also locking the data from readout if the device is using FDE 2) Cops now take the SIM card, compel the provider to provide the PUK to unlock the SIM card and insert it into their own smartphone 3) Cops activate WhatsApp and n…
That's why WhatsApp allows you to verify your recipient's key out of band. The scenario you describe would cause the identity key to change and trigger a notification if one of the potential clients has that option enabled.
There's really no way to avoid out-of-band key verification in end-to-end encrypted messaging unless you fully trust the service. Other than that, the best you can hope for is after-the-fact detection of MitM attacks through something like Key Transparency, but that still requires that someone's actively looking for that.