A serious vulnerability is discovered in Whatsapp’s end-to-end encryption that allows allow Facebook and others to intercept and read encrypted messages. The reason for the flaw is improper encryption key management and there are further details on the story here. Here to comments on this story is security experts from ZoneFox, RES, Venafi, ZoneFox, RES, Thales e-Security, Varonis, Echoworx, AlienVault, ESET, Digital Guardian and Positive Technologies.
Dr. Jamie Graves, CEO, ZoneFox:
“While a lot of the focus of this latest revelation will be on the personal implications for billions of WhatsApp users, businesses should also be extremely concerned. In today’s world, many work related topics – often highly sensitive and at the highest levels are shared on the platform. It now appears there has been a host of information available to anyone with the know how to get hold of it, we can only ponder as to whether any breaches have taken place and if they have what levels of sensitive data have been taken. Furthermore, the advent and soaring popularity of WhatsApp desktop, now means millions of employees actually use the software on company devices, providing a potentially open gate to highly sensitive company servers and information.
This vulnerability must serve as a severe warning to businesses to be as vigilant as possible and pay close attention to the security dangers that lurk in the least obvious places, within their organisation.”
Jason Allaway, VP of UK & Ireland, RES:
A combination of security, self-service and automation needs to be employed by forward-thinking organisations to give their employees comparative alternatives to Whatsapp – alternatives that can be checked, approved and easily served to workers that want speedy, secure communication.
Commenting on this, David Gibson, VP of strategy and market development at Varonis, said “We laugh when high profile individuals like President-Elect Trump say we should communicate sensitive data with paper and pen, but in an age of daily data breaches, consumers need to assume their communications won’t remain private for long. Even with applications like WhatsApp that claim no one can snoop on their users’ communications may open themselves up to vulnerabilities through inadvertent or purpose built backdoors. Constant vigilance is the name of the game for consumers and for brands like Facebook to protect the best interests of their customers.
Jacob Ginsberg, Senior Director, Echoworx:
These revelations add to the severe lack of clarity around encryption backdoors, most recently brought about by the IP Bill. While we know consumers are willing to trade their personal information for access to seemingly free services such as WhatsApp, now is the time to ask the question “at what cost to personal privacy?” and start taking privacy more seriously.
Thomas Fischer, Threat Researcher and Security Advocate, Digital Guardian:
“You need both secure development protocols and some kind of oversight to make sure that encryption APIs and solutions like Signal, AES, or PKI are properly implemented. If they’re not, companies make themselves far more vulnerable to Man In The Middle attacks. It’s not clear whether Facebook (as owner of WhatsApp) intentionally left the backdoor “unlocked” – perhaps in order to avoid legal issues in countries they do business with – or whether this was an error.”
Jon Geater, CTO, Thales e-Security:
“Users who care about the authorities intercepting their messages are quite likely to turn on security notifications, and then the problem is almost entirely diminished. For relatively normal users in a relatively normal situation that’s all it takes to know if you are being intercepted.
“In the case of dissidents or other vulnerable people with a real reason to distrust central authorities then more elaborate operational security practices and communications protocols are needed. Just as in-band code words or signals can be used to indicate that the person you are talking to is under duress, an understanding of the way WhatsApp implements Signal would mean you would also agree a way to understand that a user really has changed their device rather than the government intercepting your communications.
“This may not be entirely convenient but serious complex problems often call for serious complex answers. As with any technology, if you’re going to trust your life to it, it’s probably best to read the manual first and find out where the limitations are.
“There is almost no problem here – it’s just another example of how a single technology is not the magic that makes all your problems go away. You still have to choose the right tools for the job and use them correctly.
Mark James, IT Security Specialist, ESET:
Kevin Bocek, Chief Cybersecurity Strategist, Venafi:
Javvad Malik, Security Advocate, AlienVault:
Alex Mathews, Lead Security Evangelist EMEA, Positive Technologies:
If WhatsApp hides such a security hole behind the ‘feature’ mask, this is a bad policy for a popular public service. But should you actually care?
“Don’t think that your WhatsApp conversations were safe and totally private without the backdoor. Even if a developer or manufacturer refuses to give access to state agencies, they can still get it using zero-day vulnerability exploits, as was proven with Firefox vulnerabilities for TOR user de-anonymisation or zero-day exploits to unlock iPhones.
“If you are really concerned about privacy, if you need to keep commercial or state secrets – why are you even using WhatsApp (or any 3d-party application) for messaging?
“It is said that WhatsApp applies end-to-end encryption. But in fact, real end-to-end encryption is when my encryption key is known to me and my recipient only, when I can change that key or block it. But with WhatsApp, what do we really know about those keys? Only the things WhatsApp tell us…
“Besides, WhatApp servers can upload all the messages from your phone (you can see that feature in the web version of WhatsApp). Since most web hosting companies provide the required data to law enforcement, the feds can use this web-archiving feature anytime. No need for a backdoor, ever again!”
The opinions expressed in this post belongs to the individual contributors and do not necessarily reflect the views of Information Security Buzz.