Researchers claim WhatsApp group chats vulnerable, company denies

WhatsApp

A group of security researchers from Ruhr University in Germany has revealed a security loophole in the end-to-end encrypted messaging app WhatsApp.

Speaking to Wired, one of the researchers said: "The confidentiality of the group is broken as soon as the uninvited member can obtain all the new messages and read them". According to the German researchers, the power of any WhatsApp group lies in WhatsApp servers and not the group admin.

Responding to the report, WhatsApp said, "We've looked at this issue carefully". "Existing members are notified when new people are added to a WhatsApp group". "WhatsApp is built so group messages can not be send to hidden users and provides multiple ways for users to confirm who receives a message prior to it being sent". The researchers recommend in their paper that summarizes their findings that users who rely on absolute privacy should stick to Signal or individual private messaging. "And if not, the value of encryption is very little", he added.

He adds: "The content of messages sent in WhatsApp groups remain protected by end-to-end encryption". As for Threema, there were smaller flaws that allowed an attacker who controls servers to replay messages or add users back into a group chat. Now WhatsApp is testing a feature, which will allow a particular admin to be demoted, instead of just removing them entirely from the group. In Signal's case, the same group chat attack in WhatsApp is also found in the app. It would appear as if the new member had the permission of the admin to join. This is claimed to indicate that your name has been mentioned four times in that specific WhatsApp group.

According to the researchers, the biggest weakness of the microblogging app is its extreme dependence towards servers that negates even the efforts that are made towards end-to-end encryption.

The idea behind encryption is to muddle your messages so only you and the recipient can read texts you send.

WhatsApp representatives told Wired there would be no fixes as a result of the research and that notifications of new chat additions are warning enough.

He says that users would be notified when a new person enters the group, which prevents "silent eavesdropping".

"While our investigation focuses on three major instant messaging applications, our methodology and the underlying model is of generic goal and can be applied to other secure group instant messaging protocols as well", researchers concluded in the paper.

Related:

  • Chelsea Manning files to run for Senate seat

    Chelsea Manning files to run for Senate seat

    Manning pleaded guilty to some charges but was acquitted of the most serious charge brought against her: aiding the enemy. Manning filed her intent on January 11, according to a statement of candidacy filed with the Federal Election Commission.
    Dark Souls Remastered Switch Will Run At 1080p/30 When Docked

    Dark Souls Remastered Switch Will Run At 1080p/30 When Docked

    Unfortunately, full support of mouse and keyboard on PC, the creators of Dark Souls Remastered did not provide any information. A few hours later it will be announced that Dark Souls Remastered is also coming to PS4, Xbox One and PC.
    Will Call Pakistan's Nuke Bluff If Tasked To Cross Border: Army Chief

    Will Call Pakistan's Nuke Bluff If Tasked To Cross Border: Army Chief

    However, Rawat admitted that the Chinese troop strength in Doklam had gone down recently. We also need to build capacity to move forces from western sector to northern sectors".
  • Got batteries? Outage stalls giant tech show in Las Vegas

    Got batteries? Outage stalls giant tech show in Las Vegas

    Playing both sides, Panasonic also showed how it is bringing Google Assistant technology to cars as well. The Consumer Technology Association, which runs CES, tweeted that it was an "isolated power outage".
    Ties with India intact, says Israeli Ambassador

    Ties with India intact, says Israeli Ambassador

    Israel already is a major weapons supplier to India, selling it an average of $1 billion of military equipment each year. The visit begins in New Delhi where Mr Netanyahu will have dinner with PM Modi and meet Foreign Minister Sushma Swaraj.
    Celebrity Big Brother's India Willoughby Stuns Housemates With Alien Abduction Claim

    Celebrity Big Brother's India Willoughby Stuns Housemates With Alien Abduction Claim

    "I know I probably share a degree of blame in that because I kept going on about gender because it was so important to me". Regretting some of her actions in the house, India confessed: "I'm not kidding myself, I got it wrong and I know that".
  • United States  freezes payment to UN agency for Palestinian refugees

    United States freezes payment to UN agency for Palestinian refugees

    UNRWA provides services to 5.3 million Palestinian refugees in the Palestinian territories, Jordan, Lebanon and Syria. Some Palestinian officials call Trump's threat blackmail.
    Anti-Walmart Group Unimpressed With Tax Bonuses

    Anti-Walmart Group Unimpressed With Tax Bonuses

    Walmart on Thursday promised full-time hourly USA employees 10 weeks of paid maternity leave and six weeks of paid parental leave. Reports of the warehouse club closures surfaced piecemeal, with five closing in IL and at least three store closures in Houston .
    Swatting suspect makes first court appearance

    Swatting suspect makes first court appearance

    Tyler Barriss, 25, made his first appearance in Sedgwick County District Court following extradition from California. Barriss was allegedly targeting the home of a young woman he met online, authorities in Calgary said.
  • MLB Agent Fired After Being Accused Of Filming Clients In The Shower

    MLB Agent Fired After Being Accused Of Filming Clients In The Shower

    Apparently those standards include not secretly filming clients while they shower, because that's what Wood's been accused of. It remains unknown which players may have been involved, though Wood represented many first-round picks in recent years.
    Fed extension gives Mass. CHIP funding through March

    Fed extension gives Mass. CHIP funding through March

    Steve Womack believes it's important to make sure CHIP is on "proper fiscal footing for an extended period of time". As it happens, that estimate only included seven years of funding, for reasons I couldn't quite figure out.
    Trump Lawyer Arranged $130K Payment for Adult Star's Silence

    Trump Lawyer Arranged $130K Payment for Adult Star's Silence

    Clifford said in a January 10 statement, which she signed with her stage name, that neither the affair nor the payoff took place. Daniels, whose real name is Stephanie Clifford , is a former adult-film star who allegedly had a sexual encounter with Trump .

Comments

Other news