Slashdot Mirror
WhatsApp Security Flaws Could Be Exploited To Covertly Add Members To Group Chats (iacr.org)
A group of crytopgraphers from Germany's Ruhr University Bochum have uncovered flaws in WhatsApp's security that compromise the instant messaging service's end-to-end encryption. WhatsApp, owned by Facebook, has over one billion active users. In a paper published last week, "More is Less: On the End-to-End Security of Group Chats in Signal, WhatsApp, and Threema," anyone who controls WhatsApp's servers, including company employees, can covertly add members to any group -- a claim that might not bode well with privacy enthusiasts. From the paper: The described weaknesses enable attacker A, who controls the WhatsApp server or can break the transport layer security, to take full control over a group. Entering the group however leaves traces since this operation is listed in the graphical user interface. The WhatsApp server can therefore use the fact that it can stealthily reorder and drop messages in the group. Thereby it can cache sent messages to the group, read their content first and decide in which order they are delivered to the members. Additionally the WhatsApp server can forward these messages to the members individually such that a subtly chosen combination of messages can help it to cover the traces. Further reading: Wired.
TFA seems vague — are one-to-one sessions safe, or are they really groups (of two people) underneath and thus subject to the same problem?
In Soviet Washington the swamp drains you.
... I'm starting to feel that many of these bugs that are discovered almost on a daily basis were actually introduced by design
IMHO, as soon as you have (it's enabled by default) backup of msgs to a gmail account, you lose any protection provided by PTP encryption. Isn't it so?
As a privacy enthusiast, I am mad as hell about this.
Posted anonymously. Thank God the slashdot Post Anonymously square will protect me.
With server access, I suspect pretty much any service has 'vulnerabilities' like this! I don't see how this is news. End to end encryption still relying on transit through secured servers that negotiate the starting sessions... There is a point of entry somewhere. If you want 100% guaranteed private communications over distance, setup your own wires and adhoc, encrypted network.
nothing else you do to fuck yourself matters/.
<tinfoil>
Does the Facebook transparency report include numbers on how many times they have been directed to monitor conversations?
</tinfoil>
Using a Facebook application is insecure by definition of it being a Facebook application. Who cares if it's "secure" or not? That doesn't make sense.
I don't respond to AC's.
"attacker A, who controls the WhatsApp server"
Someone with control of an application server can make the application do whatever they want! We're all doomed!
Who is paying for all this recent security research into the obvious? And more importantly... why didn't I think of it and get in on the racket?
If someone gains control of whatsapp servers yes they can obviously do this
If someone got control of googles servers they could skew search results... it's the same with everything
The main problem is getting your friends to switch.
1) Threema $
https://techcrunch.com/2014/02...
https://www.youtube.com/watch?...
2) Chatsecure thru Orbot
3) Riot.im
4) Wire
5) Telegram
6) Signal
7) Textsecure
8) Wickr
9) Jitsi Meet
10) Stride
I was willing to buy like 10-20 licenses of Threema, but Google Play does not allow "app gifts"...
Other methods will depend on geographical location (Google gift cards depend on the country address of each account) or require bit more technical knowledge (directly from Threema website).
Just my 2 cents
whatsapp is still a thing? people are stupid.
Entering the group however leaves traces since this operation is listed in the graphical user interface.
It's missing commas around "however." It should say:
Entering the group, however, leaves traces since this operation is listed in the graphical user interface.
Seriously? This is supposed to pass for a serious article these days? What the fuck. Proofread your goddamn papers, people— and stop sucking at grammar!
is another social networking, gov brown noser's feature.