Top
Best
New

Posted by KingNoLimit 7 hours ago

Researchers discover security vulnerability in WhatsApp(www.univie.ac.at)
138 points | 43 commentspage 2
mlmonkey 6 hours ago|
"security vulnerability" ....
londons_explore 6 hours ago||
The only fix to this is to replace phone numbers by secret 256 bit keys that are never reused...

Never gonna happen.

nicce 5 hours ago||
WhatsApp has avoided the pressure of E2EE backdoors and whatever politics because they were never needed.

1. They collect all the metadata in unencrypted format and link it to phone numbers, making a huge social graph.

2. Backups are not encrypted by default and enabling of them is pushed. So the messages were never actually encrypted for most people and police can get messages without the actual phone.

3. iCloud E2EE backup fight in UK was mostly because of 2. as people started to opt-in for encryption.

gruez 3 hours ago||
>3. iCloud E2EE backup fight in UK was mostly because of 2. as people started to opt-in for encryption.

That doesn't make any sense. Why did uk want to start a fight over icloud E2EE backups (opt-in) but not whatsapp E2EE backups (opt-in)?

nicce 2 hours ago||
> That doesn't make any sense. Why did uk want to start a fight over icloud E2EE backups (opt-in) but not whatsapp E2EE backups (opt-in)?

Default iCloud backup always included WhatsApp too, even if it was disabled in the app or the app used encrypted backups. And many other things, so it was not only about WhatsApp. Even for WhatsApp alone, it was slightly more useful.

Sophira 5 hours ago|||
Phone numbers were never supposed to be secret.

Nor were social security numbers.

hdgvhicv 5 hours ago|||
We used to put phone numbers and addresses in printed books and give them to everyone.
hsbauauvhabzb 3 hours ago|||
Phone numbers are treated as permanent even though they’re ephemeral. So here we are.
tamimio 5 hours ago||
That’s not gonna happen because the whole idea is to link your real identity to the digital one, which is why you should never trust any company that refuses to give you an alternative option to the phone number.
jojobas 4 hours ago||
But it's to combat spam, we swear! Because of course there is no spam in whatsapp!
alex1138 5 hours ago||
The security vuln is that it's owned by a bad faith actor

https://news.ycombinator.com/item?id=1692122

https://news.ycombinator.com/item?id=25662215

I get this is snarky and it being HN I'll now collect my downvotes, but really, I can't not hear Whatsapp without also thinking Facebook; the entire product may as well be a security vuln

TZubiri 7 hours ago|
Security vulnerability is a bit strong, but I don't blame news salesmen for making clickbait, it's all in the game
Krasnol 6 hours ago|
If you can identify a person in a country where WA shouldn't be available by sniffing out their profile, it may even end up being a deadly security vulnerability, but I don't blame someone on a tech bro forum for making a edgy comment, it's all in the game.
varenc 2 hours ago|||
The vulnerability here is that the contact discovery endpoint could be abused to enumerate all WhatsApp users en-masse.

It's still quite possible to discover a single or small set of existing WhatsApp users based on their phone number. So in your scenario the risk still exists, it's just more work to enumerate everyone. Everyone should still assume their phone number can be linked to their WhatsApp account.

TZubiri 2 hours ago||
>Everyone should still assume their phone number can be linked to their WhatsApp account.

But this has always been the case, the phone numbers are public, and phone numbers are the public key to whatsapp accounts.

Also you always could check a specific number to see if it is a whatsapp user. It is certainly an issue if a single actor can query 500 million users in a matter of minutes, and there seems to be some additional information per account like what device they are in. But these seem relatively minor.

varenc 1 hour ago||
we agree. Just pointing out to the parent commenter that in their scenario the risk hasn't fundamentally changed. Just before the vuln was fixed it was a bit easier.
j16sdiz 4 hours ago||||
To create a whatsapp acccount, you need to authenticate with sms first. If the country is that strict around whatsapp, this alone would bring you trouble.
perch56 5 hours ago||||
In a kinetic warfare or authoritarian context, this is rather a life safety vulnerability. In the industry, we call this the crossover from Information Security (InfoSec) to Operational Security (OpSec), where a digital flaw becomes a Kinetic Threat.
TZubiri 2 hours ago|||
Right, but if a country being at war or in a authoritarian regime is a precondition for the vulnerability to pose a threat, it's not really a scenario that would warrant a high scoring in some vulnerability scoring system. For sure it's a weakness and would score higher if the purpose of the technology were military.

But since this is a civilian application and not military, it doesn't seem sensible to rate vulnerabilities according to military use. The intended scope of the application makes a huge difference legally and operationally and should be triaged accordingly.

catmanjan 5 hours ago|||
[flagged]
loeg 3 hours ago||||
> If you can identify a person in a country where WA shouldn't be available by sniffing out their profile, it may even end up being a deadly security vulnerability,

What are you talking about? Like what is even the mechanism for your concern?

This is an open endpoint / not a part of the design that is intended to be confidential. If you suspected any particular individual you could always check if their phone number had a WA account.

TZubiri 2 hours ago|||
Is it edgy? I find it somewhat nuanced and sensible. What is a bit proper of pseudoanonymous tech bro forums is people larping as military grade security analysts in a forum because they are unable to live out that dream in an actual scenario where they have any power on.

If the application is actively distributed in a country and their usage is permitted by their Terms of Service, then yes Whatsapp is liable for the security of their users in that context. If however the application is not actively distributed in that country, and there are active measures like geolocalization (and asking the user what country they are from during signup) to avoid serving such countries, then usage in those countries is outside the scope of Whatsapp.

Furthermore Whatsapp is a civilian app and is not designed or guaranteed for military usage, it's outside the scope of whatsapp.

Can the technique be used as one tool of many (including a bullet) in order to kill someone? Yes, is this a deadly security vulnerability? No, of course not, that's reaching, I'm not sure what would compel these exaggerations, maybe the larping, maybe its a general hatred towards whatsapp and you just jump on any opportunity to release your pent up anger.

It's worth noting that there's a gap between the security capabilities of whatsapp and the security capabilities they are legally required to have. Whatsapp will no doubt patch this small issue and keep that gap, but WA as it stands is one of the most secure and widely used applications in the world, has had an almost impollute historical record which is why billions of users trust the application with personal and professional secrets.

P.S: Also, you always could find out if a phone number is a whatsapp user individually, just add them on whatsapp and try to message them.