WhatsApp encrypting iCloud backups of chat logs, but may be vulnerable

in iPhone
Facebook-owned WhatsApp quietly began encrypting iCloud backups of chat logs in late 2016, a report revealed this week -- though that protection may now be compromised.

"When a user backs up their chats through WhatsApp to iCloud, the backup files are sent encrypted," a spokesperson confirmed with Forbes. In theory that should prevent hackers, police, or spy agencies from being able to read transcripts, even with a subpoena or security letter delivered to Apple.

The encryption was only noticed publicly, however, when a security firm -- Oxygen Forensics -- recently claimed it was able to crack the enhanced backups. The technique does require access to a SIM card with the same phone number WhatsApp uses to send verification codes however, since this is the basis for the encryption key WhatsApp uses.

Like Apple's iMessage network, WhatsApp has become a frequent target of governments concerned that end-to-end encryption is interfering with investigations and allowing terrorists and others to operate outside of their reach. The service has come under particularly heavy fire in Brazil, where lower courts have repeatedly leveled sanctions only to have them overturned.

Some in the U.S. and U.K. governments have called for rules that would force companies like Apple and WhatsApp to be able to decrypt data on demand. That would involve deliberately weakening the encryption used, however, and/or creating a backdoor, which companies like Apple have argued would put customers at risk while simply directing malicious parties towards alternate secrecy methods.


  • Reply 1 of 3
    coolfactorcoolfactor Posts: 1,531member
    They are probably doing something as amateur as this:
    (using PHP code as an example)

    $encryption_key = md5($phone_number);

    edited May 2017 argonaut
  • Reply 2 of 3
    macxpressmacxpress Posts: 4,973member
    This is why you just use Messages....
  • Reply 3 of 3
    avon b7avon b7 Posts: 4,194member
    macxpress said:
    This is why you just use Messages....
    And in doing so, restrict your chat options to Apple devices. Not something that happens much in the real world.

    People who want security in these apps don't use WhatsApp. They use Telegram. For the rest, WhatsApp is perfectly fine and lots of people simply delete messages (empty chats) anyway.
Sign In or Register to comment.