Why WhatsApp Will Never Be Secure
Pavel DurovDate: November 20, 2019
Edited by fpoi.org
In May, I predicted that backdoors in WhatsApp would keep getting discovered, and one serious security issue would follow another, as it did in the past [1]. This week a new backdoor was quietly found in WhatsApp [2]. Just like the previous WhatsApp backdoor and the one before it, this new backdoor made all data on your phone vulnerable to hackers and government agencies. All a hacker had to do was send you a video – and all your data was at the attacker’s mercy [3].
WhatsApp doesn’t only fail to protect your WhatsApp messages – this app is being consistently used as a Trojan horse to spy on your non-WhatsApp photos and messages. Why would they do it? Facebook has been part of surveillance programs long before it acquired WhatsApp [4] [5]. It is naive to think the company would change its policies after the acquisition, which has been made even more obvious by the WhatsApp founder’s admission regarding the sale of WhatsApp to Facebook: "I sold my users’ privacy" [6].
Following the discovery of this week’s backdoor, Facebook tried to confuse the public by claiming they had no evidence that the backdoor had been exploited by hackers [7]. Of course, they have no such evidence – in order to obtain it, they would need to be able to analyze videos shared by WhatsApp users, and WhatsApp doesn’t permanently store video files on its servers (instead, it sends unencrypted messages and media of the vast majority of their users straight to Google’s and Apple’s servers [8]). So – nothing to analyze – "no evidence". Convenient.
But rest assured, a security vulnerability of this magnitude is bound to have been exploited – just like the previous WhatsApp backdoor had been used against human rights activists and journalists naive enough to be WhatsApp users [9] [10]. It was reported in September that the data obtained as a result of the exploitation of such WhatsApp backdoors will now be shared with other countries by US agencies [11] [12].
Despite this ever-increasing evidence of WhatsApp being a honeypot for people that still trust Facebook in 2019, it might also be the case that WhatsApp just accidentally implements critical security vulnerabilities across all their apps every few months. I doubt that – Telegram, a similar app in its complexity, hasn’t had any issues of WhatsApp-level severity in the six years since its launch. It’s very unlikely that anyone can accidentally commit major security errors, conveniently suitable for surveillance, on a regular basis.
Regardless of the underlying intentions of WhatsApp’s parent company, the advice for their end-users is the same: unless you are cool with all your photos and messages becoming public one day, you should delete WhatsApp from your phone.
Sources
[1] Telegra.ph Why WhatsApp will never be secure – May 15, 2019
[2] Independent WhatsApp users urged to update app immediately over spying fears – November 20, 2019
[3] Mashable WhatsApp Android and iOS users are now at risk from malicious video files – November 18, 2019
[4] The Verge Everything you need to know about PRISM – July 17, 2013
[5] USA Today NSA taps data from 9 major Net firms – June 6, 2013
[6] Mashable WhatsApp co-founder Brian Acton: 'I sold my users' privacy' – September 26, 2018
[7] Techspot Hackers can use a WhatsApp flaw in the way it handles video to take control of your phone – November 19, 2019
[8] The Inquirer WhatsApp is storing unencrypted backup data on Google Drive – August 28, 2018
[9] Financial Times WhatsApp hack led to targeting of 100 journalists and dissidents – October 29, 2019
[10] Reuters Exclusive: Government officials around the globe targeted for hacking through WhatsApp - sources – October 31, 2019
[11] The Times Police can access suspects’ Facebook and WhatsApp messages in deal with US – September 28, 2019
[12] Bloomberg Facebook, WhatsApp Will Have to Share Messages With U.K. – September 28, 2019