Download - in WhatsApp

Transcript
Page 1: in WhatsApp

https://tobi.rocks/

WhatsApp Backdoor (/Bug?)Anotherreasonfornottrustingclosed-sourcecrypto

Page 2: in WhatsApp

https://tobi.rocks/

WhatsApp

• 1billionmonthlyactiveusers(February2016)• 1/7ofworldpopulation

• end-to-endencryption“completely”implementedApril2016• ImplementstheSignalprotocol

SignalPrivateMessenger

Page 3: in WhatsApp

https://tobi.rocks/

The Backdoor

Alice Bob

Page 4: in WhatsApp

https://tobi.rocks/

The Backdoor

Alice Bob

1

Page 5: in WhatsApp

https://tobi.rocks/

The Backdoor

Alice Bob

12

Page 6: in WhatsApp

https://tobi.rocks/

The Backdoor

Alice Bob

AliceandBobmeetinpersonandverifythefingerprint

12

3

Page 7: in WhatsApp

https://tobi.rocks/

The Backdoor

Alice Bob

Page 8: in WhatsApp

https://tobi.rocks/

The Backdoor

Alice Bob

4 “HiBob”

Page 9: in WhatsApp

https://tobi.rocks/

The Backdoor

Alice Bob

4 “HiBob”

5

Page 10: in WhatsApp

https://tobi.rocks/

The Backdoor

Alice Bob

4 “HiBob”

5

6 “HiBob”

Page 11: in WhatsApp

https://tobi.rocks/

The Backdoor

Alice Bob

4 “HiBob”

5

6 “HiBob”

7

Bob’ssecuritycodehaschanged

Page 12: in WhatsApp

https://tobi.rocks/

The Backdoor

Alice Bob

4 “HiBob”

5

6 “HiBob”

7

Bob’ssecuritycodehaschanged 8 “HiBob”

Page 13: in WhatsApp

https://tobi.rocks/

Alice’sPhone Attacker Alice’sPhone

Page 14: in WhatsApp

https://tobi.rocks/

Signal is doing it right

• Thewarningisdisplayed• Themessageisneverretransmitted

Page 15: in WhatsApp

https://tobi.rocks/

Disclosure Timeline

Page 16: in WhatsApp

https://tobi.rocks/

Disclosure Timeline

• WhitehatreportonApril10

Page 17: in WhatsApp

https://tobi.rocks/

Disclosure Timeline

• WhitehatreportonApril10• Facebook,May25:“Thisisexpectedbehavior”

Page 18: in WhatsApp

https://tobi.rocks/

Disclosure Timeline

• WhitehatreportonApril10• Facebook,May25:“Thisisexpectedbehavior”• Me:“Thisshouldnotbeexpectedbehavior.“

Page 19: in WhatsApp

https://tobi.rocks/

Disclosure Timeline

• WhitehatreportonApril10• Facebook,May25:“Thisisexpectedbehavior”• Me:“Thisshouldnotbeexpectedbehavior.“• Facebook,May31:“Wewerepreviouslyawareoftheissue[…]fornowit'snotsomethingwe'reactivelyworkingonchanging”

Page 20: in WhatsApp

https://tobi.rocks/

Disclosure Timeline

• WhitehatreportonApril10• Facebook,May25:“Thisisexpectedbehavior”• Me:“Thisshouldnotbeexpectedbehavior.“• Facebook,May31:“Wewerepreviouslyawareoftheissue[…]fornowit'snotsomethingwe'reactivelyworkingonchanging”• Status(December28):Notfixed

Page 21: in WhatsApp

https://tobi.rocks/

More reasons to use Signal

• Signalisopensource• Signalhasmostlyreproduciblebuilds• WhatsAppmaystoreMetadata(accordingtoprivacypolicy)

• timestampinformation• successofmessagedelivery• phonenumbersofsenderandrecipient• contactlists• “otherinformation”

• Signalstoresless:• lastdayauserconnected• contactlistsarenotstoredonsignalservers