Critical WhatsApp crypto flaw threatens user privacy, researchers warn
Critical WhatsApp crypto flaw threatens user privacy, researchers warn

                      
                      
          A security researcher said he has found an encryption flaw that makes it possible for adversaries to decrypt communications sent with WhatsApp, a cross-platform smartphone app that processes as many as 27 billion instant messages each day.
WhatsApp developers say messages are "fully encrypted," and company CEO Jan Koum told Ars that Tuesday's vulnerability report is "sensationalized and overblown." But a computer science student at Utrecht University in the Netherlands—and several cryptographers who have reviewed his work—said the app appears to contain long-documented weaknesses, including the use of the same encryption key on both sides of a conversation. As a result, they said, it's not hard for cryptographers to decrypt WhatsApp messages that travel over Wi-Fi networks or other channels that can be monitored.
"You should assume that anyone who is able to eavesdrop on your WhatsApp connection is capable of decrypting your messages, given enough effort," Utrecht computer science and mathematics student Thijs Alkemade wrote in a blog post published Tuesday. "You should consider all your previous WhatsApp conversations compromised. There is nothing a WhatsApp user can do about this... except to stop using it until the developers can update it."
Alkemade posted this follow-up that documents the vulnerable crypto scheme in the Android version of WhatsApp. He said he suspects that other versions of the app behave similarly. Several cryptographers with no ties to Alkemade who have reviewed the posts said the findings are serious.
"It’s an extremely bad flaw that lots of people know how to exploit," Thomas Ptacek, a recognized security consultant and cryptographer, wrote in a discussion on Twitter. "The attacker does not need to be in the middle or to have any influence over the messages." Most recently, Ptacek was one of the researchers behind a heavily attended talk at the Blackhat security conference imploring cryptographers to transition to newer forms of encryption.
For their part, however, WhatsApp officials downplayed Alkemade's assessment.
"WhatsApp takes security seriously and is continually thinking of ways to improve our product," company CEO Koum wrote in an e-mail to Ars. "While we appreciate feedback, we're concerned that the blogger's story describes a scenario that is more theoretical in nature. Stating that all conversations should be considered compromised is inaccurate. Basically, this is sensationalized and overblown. Please report responsibly and do research that goes beyond twitter-sphere. We have a company to run. Back to work."

          
                      
                  