<story><title>NSO hacked WhatsApp to spy on top government officials at U.S. allies</title><url>https://www.reuters.com/article/us-facebook-cyber-whatsapp-nsogroup/exclusive-whatsapp-hacked-to-spy-on-top-government-officials-at-u-s-allies-sources-idUSKBN1XA27H</url></story><parent_chain><item><author>vocatus_gate</author><text>A buddy of mine is Special Forces (U.S.). He said JSOC recently banned use of WhatsApp and encouraged everyone to switch to the open-source Signal (another encrypted messaging app). Allegedly WhatsApp uses Signal&amp;#x27;s encryption (OpenWhisper) but I stopped trusting it the second Facebook bought them out.</text></item><item><author>milofeynman</author><text>The article doesn&amp;#x27;t really say what hackers had access to, but it sounds like they had full control over their phones. There is a lot bigger story here and I&amp;#x27;d love to read a post-mortem in a few months.&lt;p&gt;Also, WhatsApp is such an obvious target for a state actor. I saw several articles of the last year that mentioned Jared Kushner using Whatsapp so I assume a lot of government folks use it for off the books &amp;quot;encrypted&amp;quot; communication.</text></item></parent_chain><comment><author>e12e</author><text>&amp;gt; Allegedly WhatsApp uses Signal&amp;#x27;s encryption (OpenWhisper&lt;p&gt;About the partnership:
&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;signal.org&amp;#x2F;blog&amp;#x2F;whatsapp-complete&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;signal.org&amp;#x2F;blog&amp;#x2F;whatsapp-complete&amp;#x2F;&lt;/a&gt;&lt;p&gt;But of course, in this case the issue seems to be either compromise of the device(s) via zero days, whatsapp usage simply being the target matrix - and&amp;#x2F;or a leveraging a zero day in whatsapp for full device compromise.&lt;p&gt;It&amp;#x27;s unlikely signal would be immune - they didn&amp;#x27;t Crack the encryption, they cracked the app&amp;#x2F;os.&lt;p&gt;In olden times the vector might have been a font, or a gif.&lt;p&gt;The only advantage signal has is a conservative interface and small userbase. I&amp;#x27;m not sure if they do some kind of hard-line whitelisting of attachments though - if you can pack an exploit as a file, I&amp;#x27;m pretty sure you could send it via signal.</text></comment>
<story><title>NSO hacked WhatsApp to spy on top government officials at U.S. allies</title><url>https://www.reuters.com/article/us-facebook-cyber-whatsapp-nsogroup/exclusive-whatsapp-hacked-to-spy-on-top-government-officials-at-u-s-allies-sources-idUSKBN1XA27H</url></story><parent_chain><item><author>vocatus_gate</author><text>A buddy of mine is Special Forces (U.S.). He said JSOC recently banned use of WhatsApp and encouraged everyone to switch to the open-source Signal (another encrypted messaging app). Allegedly WhatsApp uses Signal&amp;#x27;s encryption (OpenWhisper) but I stopped trusting it the second Facebook bought them out.</text></item><item><author>milofeynman</author><text>The article doesn&amp;#x27;t really say what hackers had access to, but it sounds like they had full control over their phones. There is a lot bigger story here and I&amp;#x27;d love to read a post-mortem in a few months.&lt;p&gt;Also, WhatsApp is such an obvious target for a state actor. I saw several articles of the last year that mentioned Jared Kushner using Whatsapp so I assume a lot of government folks use it for off the books &amp;quot;encrypted&amp;quot; communication.</text></item></parent_chain><comment><author>dan-robertson</author><text>If one assumes that WhatsApp are implementing the protocol as well as signal are (which I do), then I think there are three questions in deciding what is more secure:&lt;p&gt;1. Do you trust Facebook (or open whisper systems) with your metadata&amp;#x2F;expect them to delete it?&lt;p&gt;2. How likely are there to be bugs (in the app, not in the protocol itself) which lead to exploits. On the one hand WhatsApp probably have more people working on the app and likely more security people too. On the other hand they may be pushed to add more features and having lots of code churn may introduce security holes.&lt;p&gt;3. How much work will be put into exploiting each app. On the one hand more people use WhatsApp but on the other, I guess security conscious people may be more likely to use signal.&lt;p&gt;A known exploit to WhatsApp happened due to 2 with a bug in how audio calls were initiated. I don’t really have a good guess as to how the apps compare on points 2 and 3 but I guess WhatsApp loses on 1. A more practical point is that it’s likely easier to convince someone to use WhatsApp than signal, especially for group chat.</text></comment>