Slashdot Mirror
Encrypted WhatsApp Message Recovered From Westminster Terrorist's Phone (indiatimes.com)
Bruce66423 brings word that a terrorist's WhatsApp message has been decrypted "using techniques that 'cannot be disclosed for security reasons', though 'sources said they now have the technical expertise to repeat the process in future.'" The Economic Times reports:
U.K. security services have managed to decode the last message sent out by Khalid Masood before he rammed his high-speed car into pedestrians on Westminster Bridge and stabbed to death a police officer at the gates of Parliament on March 22. The access to Masood's message was achieved by what has been described by security sources as a use of "human and technical intelligence"...
The issue of WhatsApp's encrypted service, which is closed to anyone besides the sender and recipient, had come under criticism soon after the attack. "It's completely unacceptable. There should be no place for terrorists to hide. We need to make sure that organisations like WhatsApp, and there are plenty of others like that, don't provide a secret place for terrorists to communicate with each other," U.K. home secretary Amber Rudd had said.
Security sources say the message showed the victim's motive was military action in Muslim countries, while the article adds that though ISIS claimed responsibility for the attack, "no evidence has emerged to back this up."
The issue of WhatsApp's encrypted service, which is closed to anyone besides the sender and recipient, had come under criticism soon after the attack. "It's completely unacceptable. There should be no place for terrorists to hide. We need to make sure that organisations like WhatsApp, and there are plenty of others like that, don't provide a secret place for terrorists to communicate with each other," U.K. home secretary Amber Rudd had said.
Security sources say the message showed the victim's motive was military action in Muslim countries, while the article adds that though ISIS claimed responsibility for the attack, "no evidence has emerged to back this up."
The claim is dubious. Why would they inform all the Terrorists that they can decrypt WhatsApp with ease? They wouldn't. The reason for the "disclosure" is to influence Terrorists to use some other - perhaps less secure - means of communication because they CAN NOT decrypt WhatsApp.
If you want news from today, you have to come back tomorrow.
WhatsApp backdoor. Can be nothing else.
It is completely unacceptable that history majors like Amber Rudd, who evidently has not the slightest understanding of technology, end up in positions like Home Secretary. or "Secretary of State for Energy and Climate Change". Rudd seems to be an object lesson in how money and political connections trump competency and skill.
Regardless if the claim is true or not, all your data and messaging should be encrypted at all times PERIOD! I will gladly accept terror acts for the right to have my data protected and safely stored. Across all my computers and my phone, everything is encrypted when possible, including my emails, which are sent from a encrypted provider, my SMS messages, which are sent encrypted and almost everything else I do. Encryption is a right to not have your data / personal information exposed and one that must be protected, even if that means acts of terror are untracable / untrackable.
(OBNOTE: they might have done something far different, but this is one way it could be done -- and it is being done in Brazil):
1. Clone the victim's phone line (not chip, not iemsi, you just need to reassign its phoneline. Costs about US$100 in Brazil to get a sleazy, disgruntled phone-company-cellphone-outlet employee to do it for you).
2. Using the rogue SIM that has the victims' phone number active for a while, install whatsup. Do the SMS verification, it will pass. And yes, that *does* mean you could use the same !@#$@#$ trick to invade banking accounts, steal accounts with SMS verification enabled, etc. Say, like google, microsoft, or DNS registrar (and from there, anything else, such as US$ 200k-worth twitter identities, etc).
==> IT IS NO JOKE that the newest US gov regulations *strongly recommends against* (read: FORBID) the use of anything phone-carrier-routed (SMS, voice, phone number, etc) for security id/validation.
3. Whatsup will download the message history and contacts database, and you have access to the information.
Now, if the target is not an imbecile, he has whatsup 2FA enabled. That means step (2) is a lot more difficult, *but not impossible*. Here's where human intelligence can help, phone hacking can help, and even a court order for whatsup to NOT nuke the account no matter how many failed tries (assuming this does not run afoul of whatever protections did not allow them to order whatsup to shell out the history directly) can help.
IOW: have you removed the insanely dangerous "phone-number-based" recovery options of every account you treasure? If you did not, you better do now. It is quite possible to add defensive layers to SMS-based and voice-based recovery options, but all of them are of the "force several successful attempts over a *large* period of time, with random factors involved" so that the victim will notice what is happening, recover his phone number, and engage defensive measures. NOBODY implements this.
I must assume that the phrase 'the victim's motive' in the summary should be 'the terrorist's motive'.
If there's no place for terrorists to hide then there's no place for *anyone* to hide, and that is unacceptable considering how valuable it is to hide from oppression or the abusers of the system used to ensure there are no hiding spots, those who operate the system are disproportionately advantaged and with access comes the capability of concealing themselves, censoring, framing content and concealing context, etc.
This idea is ridiculous and imbalanced off the bat.
Twinstiq, game news
We need encryption to ensure that no third party, especially government and investigators cannot see our messages.
I require protected communications, and if that helps the terrorists then so be it.
'nuff said
riddled with security weaknesses you could drive a truck through
Other than to declare quite publicly, "WHATSAPP IS KILL!" to anybody who might otherwise trust it?
Here's the original article that this is all based on.
Anons need not reply. Questions end with a question mark.
And quit voting to give those statist control freaks more money and power.
You don't want the government to read your email or listen in on your phone calls? Then quit pining for single-payer health care
Do you REALLY think you can safely give a government that's already trying to watch your every move that much power and still retain any liberty or privacy?
REALLY?!?!?!
They want you to think that they think they can trick you to using what's app by saying they can decrypt it when they can so that you will think they are saying they can decrypt it so you will think they can't because they are saying they can.. And yes that also makes no sense, just like your post.
Some drink at the fountain of knowledge. Others just gargle.
I am personally insulted by the ineptitude of this troll. Please try again. This time with feeling.
Post may contain irony: discontinue use if experiencing mood swings, nausea or elevated blood pressure.
Totally agree! But you made a typo. That is the Republicans' social platform.
They hate us so they constantly lie. This was an accident but they hate us so they lie.
The main UK newspaper reports say the security services/police have interviewed the person he sent the message to, so have probably just looked at that persons phone, or used the dead terrorist's hand to unlock the phone.
They had a specifically targeted phone, they used "human and technical intelligence" to get into it. No broad request (specifically from them, anyway, in this case) to compromise everyone else's personal privacy and financial security in pursuit of their goal.
On the face of it, at least, this seems to be what I would want them to do.
#DeleteChrome
You don't know what the WhatsApp "app" is doing. It is closed source. It could be sending all your messages directly to the NSA. Why would you trust your communications to closed source running on a megacorporations system?
We can't tell you how we did it, but trust us, we totally decrypted this message. And it named these people as accomplices. What's that? Those were the same people who organized some innocuous protest against government overreach last week? Huh, must be a coincidence.
In the US anyway, freedom is worth dying for. The best way to fuck the terrorists is to show them that they can't change anything about our social norms. As far as I'm concerned, Whatsapp should be considered an in-the-clear messenger which is only "encrypted" because the government happens not care about the sender at this particular moment. What this sort of "pretend encryption" approach does is let the terrorists know that we're willing to give up our core values so they won't kill anymore of us. Heck, why stop there? We all might as well convert to their perverted brand of Islam. Of course, this is all misguided because eventually they'll find out how to do more damage, encryption or not. Which means we'll still have terror attacks a century from now, but what we won't have is private messaging.
What do we need in order to reclaim the freedom that our ancestors (in America, at least) literally died for? Open source everything, from the circuit diagrams in our chips all the way to the app layer. Is this happening? I hope I'm just ignorant, but the answer would seem to be "no". There's no "real money" in open source anything, and things are getting exponentially more complicated with time. So maybe there's something to be said for building a truly dumb "combox" for private messaging and nothing else, which actually could make money for the people behind it, and therefore be economically viable. Does anyone know of anything like this? And no, I'm not talking about some "brilliant" encryption app running on top of swiss cheese dogshit like Android.
Before encrypted electronic communications, criminals and terrorists had to use things like in-person meetings or unsecure communications methods (like analog telephony) to communicate. These were obviously vulnerable to being listened to for a determined party, but that was simply how it was, there was no other option. Law enforcement could use various human-powered means to target specific individuals or organizations, like tapping a particular phone line and having a human listen to it when it went active, or maybe stake out a particular meeting place with some high-power microphones. For the general non-criminal population, while it was technically possible for the government to listen to everyone all the time, it was realistically impractical because of the vast amount of manpower it would require.
Today we're in the opposite situation. Law enforcement can now get ahold of all electronic communications through various taps, but if criminals and terrorists use the proper technology and best practices, it is *impossible* for law enforcement to know what is being said. (Yes, deep-cover operatives are still possible but are impractical for all but the absolute highest-priority things for reasons of time, risk, and the same old manpower problem).
I don't have a great answer. Anything is either too insecure or seems too vulnerable to corruption. The only thing I've come up with is third-party escrow of encryption keys, but who is the third party and how do we know they aren't corrupt?
https://blogs.spectator.co.uk/2017/04/terrorism-teaches-lesson-still-refuse-learn/
"These messages, sent to a friend, reveal that the 52-year old convert:
‘Declared that he was waging jihad in revenge against Western military action in Muslim countries in the Middle East’"
How odd. I read that it was the recipient of the message who went to the police and gave them his phone.
Stay on topic, Donnie. It's your 100th day on the job.
I understood WhatsApp covered the communication of the data (message) in motion (transit). If they have recovered a message from the phone, that is data at rest and WhatsApp's encryption seem to have little to do with it. Even if WhatsApp does encrypt the message locally, the keys are on the device, rendering the encryption moot.
1. bruteforce (will not happen) and 2. the maker of the app and/or the phone will say the messages are encrypted, but lie, and will eventually hand the contents over when asked to.
Don't think your communications are secure if you use iPhone or Android.
Whatsapp is proven insecure and it is also not identical to whisper but in fact a derivative... Do not use it for secure messaging, only signal remains confidently secure end to end https://www.schneier.com/blog/...
I know a sure-fire legal way to ensure apps like this don't allow terrorists to communicate:
When you install it, it will ask, "Are you a terrorist? [Y/N]"
You're welcome.
It is pitch black. You are likely to be eaten by a grue.
Then have the police/military spy on them, which is easy because you're not letting the terrorists hide. Right?
It's completely unacceptable.
It's also unacceptable that terrorists have cars for making self-propelled bombs, or knives for killing unarmed police officers. How about banning those tools too?
There should be no place for terrorists to hide. We need to make sure that organisations like WhatsApp, and there are plenty of others like that, don't provide a secret place for terrorists to communicate with each other," U.K. home secretary Amber Rudd had said.
This can also be read by replacing "terrorists" with "government" with respect to harming the people they are supposed to be representing. Because naturally neither EVER lies to us nor do they have secret communications that only they are privy.
Clearly our Home Secretary Amber Rudd has now found some people who "understand the necessary hashtags": http://mashable.com/2017/03/27...
Without disclosure of how they achieved the result, it is just another unverifiable assertion.
If there's no place for terrorists to hide then there's no place for anyone to hide.
You assume that our uneducated mass care. Our degrading schools and education system is making our republic and democracy a complete and utter failure because no one understands what it means anymore. This would all work when you have a majority intelligent population.
So, security by obscurity, but in reverse.