WhatsApp users are now under threat from the same kind of “text bomb” message that recently plagued iMessage users. Strings of strange characters that not only make no sense to users but confuse WhatApp itself.
Just as with iMessage, the issue is that the app’s failure to render the message will lead to a crash. The much more serious issue here, though, is that once a user has opened a message it might send the app into a crash each time it’s opened. And that could mean a user needing to delete and reinstall the app.
This latest threat was reported by WhatsApp watcher WABetaInfo on Sunday, “there isn’t a general way to describe this,” the site warned, “so we prefer to call them ‘Scary Messages’. Scary Messages are very dangerous and they can destruct your experience in WhatsApp.” According to the site, the issue has been especially prominent in Brazil, but is not getting wider traction.
The other angle to this attack is the forwarding of corrupted VCFs—contact files with multiple contacts, some of whom again have long names filled with alien characters. WhatsApp is rolling out a fix, and has said in a statement that “it has released and already begun rolling out a patch that addresses this in its latest iOS software update,” adding that “we strongly encourage users to keep their WhatsApp app and mobile operating system up to date and download updates whenever they’re available.”
This specific issue isn’t new WABetaInfo says that such attacks can be traced back as far as three years. But there was a WhatsApp Killer Message warning from the security researchers at Check Point late last year, which should have altered the platform to taking action across its various apps to deal with this kind of attack.
As then, part of the mitigating advice now in addition to ensuring you update your app is to limit those who can add you to groups to contacts only. The issue raised by Check Point was the use of groups as an attack vector to share corrupted messages with targets.
So keep an eye out for messages from new contacts and don’t open them, change your group settings right away, and make sure you have your message history backed up even though messages backed to the cloud do not have the same level of end-to-end encryption as used by the app.
Where do two octopuses enter the passwordless equation?
The two octopuses, and yes, that is the right plural even if you think it should be octopi, come into play courtesy of passwordless authentication company Secret Double Octopus. I’ve been talking to Shimrit Tzur-David, CTO and co-founder, who caught my interest as soon as she mentioned a base technology that is used to prevent the accidental launch of nuclear weapons. That technology is based upon the math of secret sharing algorithms.
Shamir’s Secret Sharing algorithm was created by Adi Shamir, the co-inventor of the Rivest-Shamir-Adleman cryptosystem algorithm. You probably know it better as RSA, used to encrypt data with a public key that can then only be decrypted with the private one. Secret sharing, where an algorithm randomizes data so as to compute different numbers (or shares) that can only define the secret or data itself when combined, forms the basis of the nuclear launch codes technology used to prevent accidental firing.
Given that most attacks on data-in-motion are likely executed through either masquerading as a legitimate party or stealthy eavesdropping on the communication, she points out, “these types of attack can be mitigated by breaking up the data to useless shares.”
Treat your shed as if a nuclear weapon was inside
Think of your data as the shed door. If you just have one lock, the password, then breaking that lock by picking it, having the key, or simply smashing it with a big hammer is all it takes to gain entry. If, on the other hand, the door was protected by multiple locks, then having a single key, picking a single lock, or smashing one with that hammer won’t get you anywhere.
Indeed, as far as a freely distributed ‘secret’ that requires a predetermined threshold of pieces to unlock it, the system is mathematically potent. In this age of data decentralization, with older cryptographic models threatened (if not yet impacted) by quantum computing, such high-assurance cryptography could open the door, if you’ll pardon the pun, for any number of use cases.
Getting rid of a single point of failure (cough – passwords) is key
Some blockchain implementations use secret-sharing, and Tzur-David also says it can be used to secure hardware modules in personal computers and smartphones. Then there’s the ‘break glass in case of emergency‘ scenario where consensus is required to reveal the secret.
Getting rid of a single point of failure like a password is always a good move, which is why I always recommend the use of two-factor authentication (2FA) as a bare minimum. Anything that can up the ante even more, and secret sharing certainly does that, has to be taken seriously. If more securely storing sensitive data in a cloud environment, for example, can be achieved in software and without specialized hardware, then I’m all for it.
Passwordless authentication is, without a doubt, the direction we should all be heading, however we get there. If a couple of octopuses can help make life difficult for hackers, then I’ll be a sucker for that technology.
This latest threat was reported by WhatsApp watcher WABetaInfo on Sunday, “there isn’t a general way to describe this,” the site warned, “so we prefer to call them ‘Scary Messages’. Scary Messages are very dangerous and they can destruct your experience in WhatsApp.” According to the site, the issue has been especially prominent in Brazil, but is not getting wider traction.
The other angle to this attack is the forwarding of corrupted VCFs—contact files with multiple contacts, some of whom again have long names filled with alien characters. WhatsApp is rolling out a fix, and has said in a statement that “it has released and already begun rolling out a patch that addresses this in its latest iOS software update,” adding that “we strongly encourage users to keep their WhatsApp app and mobile operating system up to date and download updates whenever they’re available.”
This specific issue isn’t new WABetaInfo says that such attacks can be traced back as far as three years. But there was a WhatsApp Killer Message warning from the security researchers at Check Point late last year, which should have altered the platform to taking action across its various apps to deal with this kind of attack.
As then, part of the mitigating advice now in addition to ensuring you update your app is to limit those who can add you to groups to contacts only. The issue raised by Check Point was the use of groups as an attack vector to share corrupted messages with targets.
WHATSAPP/IOS
It seems that different attack messages are designed for different platforms Android and iOS. If you see a message come through, without opening it of course, block the contact using WhatsApp’s web app and remove the message do not do this within your smartphone app as you’ll risk the crash. If that doesn’t work, perhaps because you’ve already knocked WhatsApp into a crash loop, then you will have to reinstall the app and restore you message history from a backup.So keep an eye out for messages from new contacts and don’t open them, change your group settings right away, and make sure you have your message history backed up even though messages backed to the cloud do not have the same level of end-to-end encryption as used by the app.
SECRET DOUBLE OCTOPUS
The death of the password has long since been predicted, yet here we are still talking about what might replace the things. In August, I was reporting on an impressive new Quantum ID technology that replaces passwords with tags containing 1,000 trillion atoms. But if you thought that sounded far-fetched, what about getting rid of your passwords and replacing them using technology involving nuclear launch codes and not one, but two, octopuses? Bear with me, and I’ll reveal all.Where do two octopuses enter the passwordless equation?
The two octopuses, and yes, that is the right plural even if you think it should be octopi, come into play courtesy of passwordless authentication company Secret Double Octopus. I’ve been talking to Shimrit Tzur-David, CTO and co-founder, who caught my interest as soon as she mentioned a base technology that is used to prevent the accidental launch of nuclear weapons. That technology is based upon the math of secret sharing algorithms.
Shamir’s Secret Sharing algorithm was created by Adi Shamir, the co-inventor of the Rivest-Shamir-Adleman cryptosystem algorithm. You probably know it better as RSA, used to encrypt data with a public key that can then only be decrypted with the private one. Secret sharing, where an algorithm randomizes data so as to compute different numbers (or shares) that can only define the secret or data itself when combined, forms the basis of the nuclear launch codes technology used to prevent accidental firing.
“The advantage of secret sharing in secure communication is due to its ability to safeguard the parties even in the case of a successful attack,” Shimrit Tzur-David says.
Given that most attacks on data-in-motion are likely executed through either masquerading as a legitimate party or stealthy eavesdropping on the communication, she points out, “these types of attack can be mitigated by breaking up the data to useless shares.”
Treat your shed as if a nuclear weapon was inside
Think of your data as the shed door. If you just have one lock, the password, then breaking that lock by picking it, having the key, or simply smashing it with a big hammer is all it takes to gain entry. If, on the other hand, the door was protected by multiple locks, then having a single key, picking a single lock, or smashing one with that hammer won’t get you anywhere.
“In the case of nuclear missile codes,” Tzur-David says, “secret sharing could be applied to split and randomize the full launch code sequence among multiple authorized parties to ensure that no single individual possesses enough information to single-handedly, or accidentally, initiate a launch.”
Indeed, as far as a freely distributed ‘secret’ that requires a predetermined threshold of pieces to unlock it, the system is mathematically potent. In this age of data decentralization, with older cryptographic models threatened (if not yet impacted) by quantum computing, such high-assurance cryptography could open the door, if you’ll pardon the pun, for any number of use cases.
“Quantum key distribution is limited by many factors, first and foremost by the basic physical infrastructure needed for it to work,” Tzur-David says, “but secret sharing can be used for more than just key exchange. Actual information can be transferred securely by using secret sharing methods, regardless of the encryption type used.”
This removes the need for classic encryption altogether by breaking data into meaningless pieces that can only be assembled by the legitimate recipient.
Getting rid of a single point of failure (cough – passwords) is key
“The growing use of (and dependency on) cloud computing, software-defined networks and connected edge devices,” Tzur-David says, “have brought many more ways to communicate so new parallel channels are available for things like key exchange this is why breaking secrets is not only useful but very practical.” Not only for added redundancy but for more robust security, she says, adding that “in other areas, mainly wherever data-at-rest has to be secured, secret sharing has been more popular.”
Some blockchain implementations use secret-sharing, and Tzur-David also says it can be used to secure hardware modules in personal computers and smartphones. Then there’s the ‘break glass in case of emergency‘ scenario where consensus is required to reveal the secret.
Getting rid of a single point of failure like a password is always a good move, which is why I always recommend the use of two-factor authentication (2FA) as a bare minimum. Anything that can up the ante even more, and secret sharing certainly does that, has to be taken seriously. If more securely storing sensitive data in a cloud environment, for example, can be achieved in software and without specialized hardware, then I’m all for it.
Passwordless authentication is, without a doubt, the direction we should all be heading, however we get there. If a couple of octopuses can help make life difficult for hackers, then I’ll be a sucker for that technology.