This week at B-Sides LV, security researcher Pavel Tsakalidis presented his work on security defects in the Electron framework, a cross-platform development framework that combines Javascript with Node.js: apps built with Electron include Skype, Slack, Whatsapp, Visual Studio Code and others. Read the rest
This week, we learned that the notorious Israeli cyber-arms-dealer NSO Group had figured out how hijack your Iphone or Android phone by placing a simple Whatsapp call, an attack that would work even if you don't answer the call. Read the rest
NSO Group is a notorious Israeli cyber-arms dealer whose long trail of sleaze has been thoroughly documented by the University of Toronto's Citizen Lab (which may or may not be related to an attempt to infiltrate Citizen Lab undertaken by a retired Israeli spy); NSO has been implicated in the murder and dismemberment of the dissident Saudi journalist Jamal Khashoggi (just one of the brutal dictatorships who've availed themselves of NSO tools), and there seems to be no cause too petty for their clients, which is why their malware has been used to target anti-soda activists in Mexico. Read the rest
This bodes well for WhatsApp users. Read the rest
Brazil's new president Jair Bolsonaro rode to power on a platform of racist and gendered discrimination, genocide for indigenous people, homophobia, torture apology, and the abolition of human rights; he owes his victory to political spamming and conspiracy theories spread on Facebook at Whatsapp. Read the rest
In 2014, Facebook bought the messaging system Whatsapp for $22B; it was a weird fit, because Whatsapp founders had decried Facebook's surveillance-based business model and targeted advertising, and had promised its users "No ads, no games, no gimmicks." Read the rest
The viral hoax video purporting to show child-snatchers kidnapping Indian children continues to fuel lynchmobs, whose death toll has climbed to more than two dozen victims. Read the rest
Someone edited a Pakistani child-safety education video to make it look like evidence of a ring of kidnappers was snatching children and taking them away on motorcycles; the video went viral in India, spread on Whatsapp, and it has inspired terrified mobs to attack and murder strangers on suspicion of being involved in the fictitious kidnapping rings. Read the rest
Russia's communications regulator says it has blocked IP addresses owned by Google and Amazon because Moscow claims the internet addresses are used by the Telegram messaging service that was banned by Putin's regime this week. Read the rest
South Wales Police announced they were able to access a WhatsApp user's photos through a backdoor, then extract fingerprint data from a picture of a weed dealer's hand to help convict 11 involved people. Read the rest
The lifecycle of technology is fundamentally parasitic: successful technologies are ones that colonize their predecessors, devour them, and burst out of their limiting skins to and grow into new, more ambitious tools -- until they, too, are colonized by a more-evolved successor. Read the rest
Facebook spokespeople and cryptographers say that Facebook's decision to implement Open Whisper Systems' end-to-end cryptographic messaging protocol in such a way as to allow Facebook to decrypt them later without the user's knowledge reflects a "limitation" -- a compromise that allows users to continue conversations as they move from device to device -- and not a "defect." Read the rest
Update: Be sure to read the followup discussion, which explains Facebook's point of view, that this is a deliberate compromise, and not a defect, that makes the app more usable for a wide variety of users, while putting them to little additional risk (namely, that Facebook might change its mind; or be forced to spy on its users; or suffer a security breach or internal rogue employee).
When Facebook implemented Open Whisper Systems' end-to-end encrypted messaging protocol for Whatsapp, they introduced a critical flaw that exposes more than a billion users to stealthy decryption of their private messages: in Facebook's implementation, the company can force Whatsapp installations to silently generate new cryptographic keys (without any way for the user to know about this unless a deep settings checkbox had been ticked), which gives the company the ability to decrypt user messages, including messages that have already been sent in the past.. Read the rest
The mobile messaging app will soon begin sharing with Facebook the phone numbers and analytics data for its more than one billion users.
When messaging app WhatsApp was acquired by Facebook in 2014, WhatsApp co-founder Jan Koum promised the deal wouldn't affect users' privacy. Read the rest
