Slashdot Mirror
WhatsApp Is Using IMEI Numbers As Passwords
mpol writes "In the past, WhatsApp has been criticized over their insecure use of XMPP. Recently, new versions of their app have incorporated encryption. It seems the trouble isn't over yet for WhatsApp and its users. Sam Granger writes on his blog that WhatsApp is using IMEI numbers as passwords. This is at least the case with the Android app, but other platforms are probably using similar methods. Since someone's IMEI number is easily readable, this isn't really secret information that should be used for authentication."
The intent of this blog post is not give “hackers” or “scriptkiddies” any funny ideas, but merely for awareness.
And yet , after reading the blog post, I see he made no mention of warning whatsapp, giving them a chance to alter this, etc.
Nicely done with the "responsible disclosure".
And who cares what is uses for passwords?
And why should I care?
Also. Get off my lawn.
Yes and porn is watched for the acting.
"Maybe this world is another planet's hell"
Aldous Huxley
Acronym abuse! If you use an acronym, spell it out the first time you use it, or expect your communications to be taken as nonsense.
"National Security is the chief cause of national insecurity." - Celine's First Law
Even though the UDID was not supposed to be used for authentication like purposes, some app developers were leaning on it... really better to just make apps create a UUID themselves and make use of that. Of course, then for authentication you need a real login of some kind.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
To be fair, they are using the MD5 of the IMEI. Not just the IMEI in plain text. But I think people are more worried about someone getting their WhatsApp info from the IMEI, and not the other way around.
What good would a "warning" do? This isn't some accidental security slip-up, it's a sign of utter incompetence.
Don't forget your tinfoil hat
Anybody who cares about their security with mobile texting should be using one of the services out there that are designed for it, like Gliph or TigerText.
WhatsApp has had security problems in the past, and it seems like their users really don't care.
http://javazkript.blogspot.in/p/download-thatsapc.html
Why are these people not asking _one_ person that understands security before implementing the same tired old stupid mistakes again? There is not even space for responsible disclosure here. The only things to tell users is to stay away from this insecure trash. If they make beginners mistakes like these, there is likely no way to fix this app without a complete re-design.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
But they should use the IMSI number, not the IMEI number. And combine it with a password, then you get into a better level of security than with only a password since you are using something you have.
However with the recent rise in malicious apps for phones using the phone for anything secure is risky.
If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
Couldnt they just use said IMEI and mix user name or or another mix inside of the imei for the password to keep the a identifier unique?
"If they aren't doing anything wrong, what have they got to hide? Why do they need to encrypt things?"
Any discussion about security has to have that in there somewhere. This time I got there before the NSA dude...
Anyone who writes mobile apps _must_ have noticed that Apple is removing the APIs to read UDIDs (Universal Device Identifiers) - because of privacy concerns, and because using a device to identify a user is stupid in the first place. IMEI numbers are supposed to be unchangeable, so they are UDIDs as well, so it is obvious that the reasons why UDIDs shouldn't be used apply to IMEI numbers as well.
I don't write Android code, but I would be sure that they have some easy means for an app to generate a UUID (Universally Unique Identifier) and stash it away safely, which is what an app should use.
This isn't a problem on WP7 (can't speak for 8). We needed the IMEI on a project, and only signed OEM applications can get access to it. iOS has UUID access for applications to get around this, as does WP7, but that generally raises issues around privacy.
Issues with IMEI are a bit heavier than UUID style usage. You can block an entire phone globally by reporting the phone stolen with the IMEI to participating carriers. This is irreversible. Malicious though, and rather unlikely. What's more likely is your IMEI can be sold to fake phone manufacturers, which if they ever appear on the same network as your phone simultaneously, both will get blocked globally.
The IMEI is not just "easily readable" it's sent unencrypted whenever a call is made. This was a deliberate design choice, it could have been sent after the encrypted connection was established but the writers of the specification chose otherwise - the motivations for this have never been explained but a lot of people have drawn their own conclusions.
In any case my point is that it's even easier than TFA suggests to obtain someone's IMEI.
âoeThe Mind Has No Firewallâ by Timothy L. Thomas. Parameters, Spring 1998, pp. 84-92.
The human body, much like a computer, contains myriad data processors. They include, but are not limited to, the chemical-electrical activity of the brain, heart, and peripheral nervous system, the signals sent from the cortex region of the brain to other parts of our body, the tiny hair cells in the inner ear that process...
I was half expecting this to turn into another 'MyCleanPC' spam post.
In the free world the media isn't government run; the government is media run.
So when is Jitsi going to get an android port?
Give me Classic Slashdot or give me death!
Actually the mind has a very effective firewall, as everyone has experienced who tried to convince someone else that his believe system is wrong. However, like any firewall, it can only keep off threats if configured properly.
The Tao of math: The numbers you can count are not the real numbers.
Mitt, don't you have an election to steal?
I prefer the term "finesse".
-Mitt
I just upgrade my firewall to Fox News 3.2.
Hatta, you're actually not far off from Bruce Schneier's "Full Disclosure of Security Vulnerabilities a 'Damned Good Idea'".
-rozzin.
"Since someone's IMEI number is easily readable, this isn't really secret information that should be used for authentication."
I think this should read that IMEI numbers should not be used for authentication.
I'm not FAT
I hate name calling from behind the internet. Wassup Mr. Coward?