The REAL reason end-to-end encryption is "allowed" (UNPATCHED)

Summary

This video uncovers the hidden privacy risks associated with popular end-to-end encrypted messaging apps like WhatsApp and Signal. It explains how these apps, despite their encryption, inadvertently leak highly personal data, such as device usage, location, communication patterns, and even social graphs. Using a technique involving delivery receipts and side-channel attacks, attackers can build a detailed profile of users' habits, device status, and interactions, all without malware or direct interaction. Despite being reported to the app developers, these vulnerabilities remain unpatched, raising concerns about user privacy and data security.

Takeaways

• 😀 End-to-end encrypted messaging apps like WhatsApp and Signal can leak a vast amount of personal data through side-channel attacks, even without any interaction from the user.
• 😀 Simply having these apps installed on your phone allows governments, law enforcement, and private individuals to build detailed profiles on you, including device usage patterns, location, and more.
• 😀 One of the most concerning leaks involves tracking when a user's phone is locked or unlocked, which can be exploited by adversaries for targeted operations like arrests.
• 😀 The delivery receipts used by these apps can be abused to silently track when a user’s device is online, even without the user being aware of it.
• 😀 Attackers can use malformed messages to probe a victim’s device, gaining insights into the device’s status (e.g., locked, active, or app open) without the victim being notified.
• 😀 The timing side-channel vulnerability can allow attackers to determine the state of the victim's phone, such as whether it’s locked, unlocked, or actively in use.
• 😀 These side-channel attacks can even identify the type of device the user has, based on the response times of various devices during probing.
• 😀 Despite these vulnerabilities being reported, neither WhatsApp nor Signal have responded adequately or issued patches to address the issues, leaving millions of users exposed.
• 😀 Multi-device support in these messaging apps increases the information leakage, as adversaries can count the number of devices a user has and track their activity across different devices.
• 😀 Privacy leaks also include information about whether a user is on Wi-Fi or cellular data, revealing potential details about their location or daily routines.
• 😀 The lack of adequate privacy measures, combined with the passive nature of these attacks, makes these vulnerabilities particularly dangerous, with the potential for misuse ranging from personal surveillance to targeted arrests.

Q & A

What is the core issue discussed in the video regarding apps like WhatsApp and Signal?

The core issue is that, despite offering end-to-end encryption, apps like WhatsApp and Signal still leak significant amounts of personal data. This includes information about user habits, device usage, communication patterns, and even the potential to track users through delivery receipts and timing side channels.

How do government agencies and other entities gather information on users without their knowledge?

Entities can gather information by exploiting vulnerabilities in end-to-end encrypted messaging apps. For example, by simply knowing a user's phone number, they can monitor metadata, such as when the user is online, their device usage, and their physical movements through timing side channels, without needing to interact with the user directly.

What are the two main types of messaging services discussed in the video?

The video discusses two categories of messaging services: traditional messaging services (like Snapchat and Discord), which rely on server-side encryption, and end-to-end encrypted messaging services (like WhatsApp and Signal), where the messages are encrypted directly between the users and the service has no access to the message content.

What is the difference between traditional and end-to-end encrypted messaging services in terms of privacy?

Traditional messaging services store messages on their servers and can be accessed by the service provider, potentially giving access to law enforcement or intelligence agencies. End-to-end encrypted services, on the other hand, ensure that only the intended recipients can read the messages, though metadata (such as who is messaging whom and when) can still be exposed.

What is the 'client fanout' approach to multi-device support in end-to-end encrypted apps?

The client fanout approach allows each device to manage its own encryption keys, meaning that each device used by a user gets an individually encrypted copy of the message. This approach ensures true end-to-end encryption across all devices, but it also creates privacy concerns, as it can reveal the number and types of devices a user is using.

How does an adversary exploit delivery receipts to track user activity?

An adversary can send silent probes (malformed messages) to a victim's device, triggering delivery receipts without the victim's knowledge. By monitoring these receipts, they can deduce when the victim’s phone is online, locked, or when the app is in the foreground, which can reveal the victim's daily habits and communication patterns.

What is a 'timing side channel' attack, and how does it affect user privacy?

A timing side channel attack measures the round-trip time (RTT) between sending a message and receiving the delivery receipt. By analyzing the timing differences, attackers can determine the device's state (locked, active, or app in the foreground) and gather detailed information about the user's activity, such as when their phone is on or off and what app is open.

What additional information can be extracted from the round-trip time during a timing side channel attack?

By measuring the round-trip time, an attacker can identify the device's state, such as whether the phone is locked, active, or if the app is open. This can also be used to identify the type of device being used, such as differentiating between Xiaomi and Samsung devices based on response time, further compromising user privacy.

What privacy leak occurs when an adversary can track when a user is on Wi-Fi or cellular data?

Tracking when a user is on Wi-Fi or cellular data can reveal potentially sensitive information about the user's location and habits, such as when they are at home or traveling. This type of data can be exploited to infer the user's daily routine, location, and movements.

What vulnerabilities exist in how Signal and WhatsApp handle malformed messages?

Signal and WhatsApp can be exploited by sending malformed messages that cause the app to trigger delivery receipts, revealing user activity without the user ever seeing the message. These malformed messages can be sent at high frequency, enabling the attacker to gather detailed information about the user's device activity, even without any visible interaction from the victim.