Slashdot Mirror
WhatsApp Is Using IMEI Numbers As Passwords
mpol writes "In the past, WhatsApp has been criticized over their insecure use of XMPP. Recently, new versions of their app have incorporated encryption. It seems the trouble isn't over yet for WhatsApp and its users. Sam Granger writes on his blog that WhatsApp is using IMEI numbers as passwords. This is at least the case with the Android app, but other platforms are probably using similar methods. Since someone's IMEI number is easily readable, this isn't really secret information that should be used for authentication."
The intent of this blog post is not give “hackers” or “scriptkiddies” any funny ideas, but merely for awareness.
And yet , after reading the blog post, I see he made no mention of warning whatsapp, giving them a chance to alter this, etc.
Nicely done with the "responsible disclosure".
Yes and porn is watched for the acting.
"Maybe this world is another planet's hell"
Aldous Huxley
Acronym abuse! If you use an acronym, spell it out the first time you use it, or expect your communications to be taken as nonsense.
"National Security is the chief cause of national insecurity." - Celine's First Law
Even though the UDID was not supposed to be used for authentication like purposes, some app developers were leaning on it... really better to just make apps create a UUID themselves and make use of that. Of course, then for authentication you need a real login of some kind.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
To be fair, they are using the MD5 of the IMEI. Not just the IMEI in plain text. But I think people are more worried about someone getting their WhatsApp info from the IMEI, and not the other way around.
What good would a "warning" do? This isn't some accidental security slip-up, it's a sign of utter incompetence.
Don't forget your tinfoil hat
Why are these people not asking _one_ person that understands security before implementing the same tired old stupid mistakes again? There is not even space for responsible disclosure here. The only things to tell users is to stay away from this insecure trash. If they make beginners mistakes like these, there is likely no way to fix this app without a complete re-design.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
But they should use the IMSI number, not the IMEI number. And combine it with a password, then you get into a better level of security than with only a password since you are using something you have.
However with the recent rise in malicious apps for phones using the phone for anything secure is risky.
If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
Anyone who writes mobile apps _must_ have noticed that Apple is removing the APIs to read UDIDs (Universal Device Identifiers) - because of privacy concerns, and because using a device to identify a user is stupid in the first place. IMEI numbers are supposed to be unchangeable, so they are UDIDs as well, so it is obvious that the reasons why UDIDs shouldn't be used apply to IMEI numbers as well.
I don't write Android code, but I would be sure that they have some easy means for an app to generate a UUID (Universally Unique Identifier) and stash it away safely, which is what an app should use.
The IMEI is not just "easily readable" it's sent unencrypted whenever a call is made. This was a deliberate design choice, it could have been sent after the encrypted connection was established but the writers of the specification chose otherwise - the motivations for this have never been explained but a lot of people have drawn their own conclusions.
In any case my point is that it's even easier than TFA suggests to obtain someone's IMEI.
âoeThe Mind Has No Firewallâ by Timothy L. Thomas. Parameters, Spring 1998, pp. 84-92.
The human body, much like a computer, contains myriad data processors. They include, but are not limited to, the chemical-electrical activity of the brain, heart, and peripheral nervous system, the signals sent from the cortex region of the brain to other parts of our body, the tiny hair cells in the inner ear that process...
I was half expecting this to turn into another 'MyCleanPC' spam post.
In the free world the media isn't government run; the government is media run.
So when is Jitsi going to get an android port?
Give me Classic Slashdot or give me death!
Actually the mind has a very effective firewall, as everyone has experienced who tried to convince someone else that his believe system is wrong. However, like any firewall, it can only keep off threats if configured properly.
The Tao of math: The numbers you can count are not the real numbers.
Hatta, you're actually not far off from Bruce Schneier's "Full Disclosure of Security Vulnerabilities a 'Damned Good Idea'".
-rozzin.
I hate name calling from behind the internet. Wassup Mr. Coward?