WhatsApp Flaw Compromises Security Of Encrypted Group Chats

WhatsApp

German researchers have claimed there is a way to infiltrate WhatsApp's group chats and listen on private messages, despite its end-to-end encryption.

"The confidentiality of the group is broken as soon as the uninvited member can obtain all the new messages and read them", Paul Rosler, one of the Ruhr University researchers, was quoted as saying.

Researchers from Germany's Ruhr University Bochum have unearthed an encryption flaw that makes it possible for group conversations to be compromised.

Reacting to the report, Facebook Chief Security Officer Alex Stamos tweeted: "Read the Wired article about WhatsApp - scary headline! But there is no [sic] a secret way into WhatsApp groups chats", he tweeted.

This is a big problem, because WhatsApp prides itself on end-to-end encryption for its messages.

But, as it turns out, the Signal protocol does not check whether the message was sent by an actual member of the group, meaning that anyone outside the group can send the message and, consequently, add a new user to the group.

The problem sits in WhatsApp's authentication mechanism for adding people to group chats.

Google Memo Author Sues, Claiming Bias Against White Conservative Men
The lawsuit is being filed by Dhillon Law Group, and former Google engineer David Gudeman is also a member of the suit . That practice is "openly denigrating male and Caucasian employees as less favored than others", the lawsuit claimed.

A flaw in popular encrypted chat programs WhatsApp, Threema and Signal theoretically allows nearly anyone to control important servers, bypass encryption and add themselves to group chats.

While the exploits in Threema and Signal seemed to be relatively harmless, WhatsApp had far more significant gaps in security.

The design flaws "allows an attacker ... controlling some of the messages sent by the WhatsApp server, to become a member of the group or add other users to the group without any interaction of the other users", according to their research paper released earlier this month.

New additions to the group chat would be notified to all members of the chat just like normal. The application has been designed in such a way that the group messages can not be sent to any hidden user. "The main exception to this is former group members, who already know the group ID - and can now add themselves back to the group with impunity". Additionally, shared messages can be encrypted too. Since the group ID is a random 128-bit number (and is never revealed to non-group-members or even the server) that pretty much blocks the attack.

The objective of having an end-to-end encryption is to stop trusting the intermediate servers in such a way that even the company or the server that transmits the data can decrypt the messages or abuse the centralized position.

A WhatsApp spokesperson said to the Wired that "no one can secretly add a new member to a group and a notification does go through that a new, unknown member has joined the group". "It could even prevent any administrator's attempt to remove the eavesdropper from the group if discovered", Rösler said.

Related News:



Most liked

FERC rejects Perry plan to boost coal, nuclear
He said the FERC order to seek more information about resilience was "only the first step" rather than a final one. As an independent body, FERC isn't required to follow policies suggested by Trump, Perry or the administration.

Bad Lip Reading Trolls Donald Trump At The National Championship Game
The president left the game shortly before halftime. "So unprecedented as far as I know", tweeted Vaughn Esham . They were joined on the field by President Donald Trump , who attended the game.

Golden Globes Opening Speech: Seth Meyers Tackles Kevin Spacey & Harvey Weinstein
Getty in Ridley Scott's drama All the Money in the World . "Marijuana is finally allowed, and sexual harassment finally isn't". The audience laughed as Meyers referred to Plummer having replaced Spacey for his role as real-life oil tycoon J.P.

Astros GM: 'Nothing imminent' in deal for Pirates RHP Cole
Pirates right-hander Gerrit Cole delivers a pitch during the first inning against the St. Cole turned heads in 2015 when he made the All-Star Game and posted sparkling numbers.

Lenovo makes shooting VR easy with Mirage camera and Daydream headset
These VR180 cameras will help anyone shoot 3D, immersive photos and video without having to shell out loads and loads of cash. It is powered by a Qualcomm Snapdragon 835 processor with 4GB of RAM, while the lenses provide 110 degrees field of view.

Louisiana teacher removed from school board meeting in handcuffs
While she was being recognized by the superintendent, an Abbeville city marshal approached her and asked her to leave. I don't care if the performance targets are met - you're making our jobs even more hard .

Kia Niro EV Concept Plugs Into CES
Kia says the current powertrain found here utilizes new production technology which will be applied to other near-future vehicles. Woong-chul Yang said: "Kia's connected cars will be both boundless and connected and offer a new kind of mobility experience".

South Korea to unveil decision over 'comfort women' deal with Japan
The Trump administration has agreed to delay joint military exercises with South Korea until after the Olympics. It's not my understanding that they're going to talk about anything further.

Packers Introduce Gutekunst, Announce Office Changes
The Colts offensive line has been very inconsistent during Philbin's tenure and a change is arguably needed. Prior to coming to Green Bay, Gutekunst spent a season as a scouting assistant with the Chiefs.

President Oprah? After the Golden Globes, Some Have a 2020 Vision
DeMille Award at the 2018 Golden Globes, she told the audience that "everyone loves Oprah". Winfrey brought the typically rowdy crowd to silence and tears with her speech.

South Africa beat India by 72 runs in first Test
Captain Virat Kohli was the second-highest scorer with 28 as the hosts took a 1-0 lead in the three-match series. South Africa would have probably thought of batting long and then give a big target to India .

Former UGA player Matt Stinchcomb elected to College Football Hall of Fame
But he learned Monday that he has already gained inclusion in the College Football Hall of Fame in December. His 21 career interceptions and 389 interception return yards still stand as Miami and Big East records.

Chiefs RBs coach Eric Bieniemy emerges as OC candidate
Nagy was expected to be high on the list for the Colts, especially considering his history with general manager Chris Ballard. The Chiefs won the AFC West, only to blow an 18-point halftime lead in a playoff loss to Tennessee on Saturday.

Here's your early look at the Nokia 6 (2018)
Elsewhere, the speaker setup on-board the original Nokia 6 came with dual amplifiers and support for Dolby Atmos sound technology. The second-generation of the Nokia 6 is now up for pre-order in China, with no word quite yet on when or if it will hit the US.

Firefighter among 3 injured in Trump Tower rooftop fire Secret Service spotted
It took about an hour to put out the fire at the building, which is located on Fifth Avenue in Manhattan. The fire department reported that the blaze burned on the roof of the building rather than inside it.