Categories: News

WhatsApp Built Backdoor into its Encryption

WhatsApp, the Facebook-owned instant messaging app, features a security backdoor that allows the company to intercept and decrypt private messages sent through the platform, in flagrant contradiction of its previous stance that it employed end-to-end encryption. While WhatsApp uses encryption developed by Open Whisper Systems, the company behind end-to-end encryption SMS app Signal, the company has built in a protocol that allows the ability to generate new encryption keys for offline users, which then allows WhatsApp employees to access these messages.

The backdoor was found by University of California researcher Tobias Boelter, who reported the issue to Facebook last year. Facebook responded by assuring Boelter that the backdoor was “expected behaviour,” i.e. deliberate.

“If WhatsApp is asked by a government agency to disclose its messaging records, it can effectively grant access due to the change in keys,” Boelter told The Guardian.

“WhatsApp can effectively continue flipping the security keys when devices are offline and re-sending the message, without letting users know of the change till after it has been made, providing an extremely insecure platform,” said Steffen Tor Jensen, head of information security and digital counter-surveillance at the European-Bahraini Organisation for Human Rights, who verified Boelter’s findings.

“[Some] might say that this vulnerability could only be abused to snoop on ‘single’ targeted messages, not entire conversations,” Boelter added. “This is not true if you consider that the WhatsApp server can just forward messages without sending the ‘message was received by recipient’ notification (or the double tick), which users might not notice. Using the retransmission vulnerability, the WhatsApp server can then later get a transcript of the whole conversation, not just a single message.”

Boelter has made his findings public in the wake of the UK passing the most oppressive mass surveillance law in the history of democracy, the Investigatory Powers Act, which collects communications data for every resident of the country for up to twelve months.

Ashley Allen

Disqus Comments Loading...

Recent Posts

Intel Unveil its Raptor Lake Desktop Processors – Core i9-13900K = $589(?)

Intel has formally announced the launch of its new upcoming Raptor Lake (Raptor Lake-S) desktop…

10 hours ago

Intel Confirms Arc A770 to Release on October 12th for $329

After months and months of speculation, and more than a few apparent delays, Intel Arc…

11 hours ago

Where to Watch the Intel Innovation (Raptor Lake/Arc Launch?) Livestream!

Intel is officially kicking off its Innovation event today at 5 PM UK time and…

12 hours ago

Nvidia 40XX 12VHPWR Adapters WILL NOT Blow Up Your PSU! – Video

Earlier this month, information appeared online from the PCI-SIG (effectively the I/O hardware cabling regulator)…

12 hours ago

Gigabyte M32UC 32″ Curved 4K 144Hz Gaming Monitor Review

The biggest compromise for most when purchasing a new monitor is often the price, so…

16 hours ago

Amazon UK Leaks(?) Intel Raptor Lake Processor Prices

Intel is expected to officially launch its new 13th-gen Raptor Lake desktop processors later today…

20 hours ago