German cryptographers found a way to breach WhatsApp group chats despite its end-to-end encryption.
Researchers announced they had discovered flaws in security at the Real World Crypto security conference in Switzerland, Wired reports. Anyone controlling the app's servers could introduce new people to private group chats without needing permission from an admin.
As soon as a new person joins, each member's phone in this group chat automatically shares secret keys with that person, granting them full access to all future messages, but not to previous ones. It appears as if the new member had the administrator's permission to participate.
“Confidentiality of the group is broken as soon as the uninvited member can receive all new messages and read them”, said Paul Rösler, one of the researchers. The researchers suggest that users who rely on absolute privacy protection should stay on Signal or in individual private messages.
The WhatsApp application, which belongs to Facebook, appears to have a fairly large security flaw. But how easy could it be to gain access to WhatsApp servers? WhatsApp servers can be controlled only by staff, governments that legally request access, and high-level hackers.
Facebook's security chief, Alex Stamos, responded to the report on Twitter, saying: “We read the Wired article today about WhatsApp – a terrifying headline! But there is no secret way for anyone to infiltrate WhatsApp groups.”
Stamos protests the report, stating that there are many ways to check and verify the members of a group chat. He argued that, given that all members of a group chat can see who is participating in the conversation, they would be notified of any other “intruders”. It is also worth wondering how a redesigned, secure WhatsApp would look without this flaw. According to Stamos, if the app were to be redesigned, the ease with which it can now be used would be reduced.
Moxie Marlinspike, a security researcher who developed Signal, which licenses its protocol to WhatsApp, stated that the current design of the application is logical and that the exposure only sends a single message to others, not “creating security for their products, as they will become a target for researchers, even if they make the right decisions.”
