{"id":340371,"date":"2017-05-08T23:44:02","date_gmt":"2017-05-08T15:44:02","guid":{"rendered":"http:\/\/techcrunch.com\/?p=1486588"},"modified":"2017-05-08T23:44:02","modified_gmt":"2017-05-08T15:44:02","slug":"whatsapp-quietly-added-encryption-to-icloud-backups","status":"publish","type":"post","link":"https:\/\/people.utm.my\/asmawisham\/whatsapp-quietly-added-encryption-to-icloud-backups\/","title":{"rendered":"WhatsApp quietly added encryption to iCloud backups"},"content":{"rendered":"

<\/p>\n

WhatsApp has quietly beefed\u00a0up the security of an iCloud backup feature for users of its messaging service \u2014 potentially closing a loophole that could\u00a0enable otherwise end-to-end encrypted messages to become accessible in a readable form. Such as via a subpoena of Apple, which holds the encryption keys for iCloud, or by a hacker otherwise\u00a0gaining access to a WhatsApp\u00a0user\u2019s iCloud account.<\/p>\n

According to a Forbes<\/a> report, the Facebook-owned giant added encryption to WhatsApp iCloud\u00a0backups in late 2016, though it says the fact only emerged last week after a third party company which\u00a0supplies mobile and cloud hacking tools claimed to be able to circumvent the security measure.<\/p>\n

The company in question, Oxygen Forensics, told Forbes\u00a0its workaround\u00a0only works for\u00a0a specific scenario whereby it has access to a SIM card with the same mobile number that\u00a0WhatsApp uses to send\u00a0a verification code to generate the encryption key for the iCloud backup.<\/p>\n

A WhatsApp spokesperson confirmed iCloud backups are now being encrypted, telling Forbes:\u00a0\u201cWhen a user backs up their chats through WhatsApp to iCloud, the backup files are sent encrypted.\u201d<\/p>\n

Forensic tools are apparently used to download the encrypted WhatsApp data backed up to iCloud. Then, using\u00a0the associated SIM, Oxygen Forensics said it can generate the encryption key for\u00a0decrypting the data\u00a0by\u00a0passing the verification process again.<\/p>\n

Forbes suggests the\u00a0method could be used, for example, by police in possession of a device where the\u00a0WhatsApp account has been deleted but iCloud backups have not been wiped.<\/p>\n

We\u2019ve reached out to WhatsApp with questions and will update this story with any response.<\/p>\n

Political pressure on encryption appears to be hotting up\u00a0again. Giving evidence to a Senate oversight committee earlier this month<\/a>, FBI director James Comey revealed\u00a0the agency\u00a0had been unable to\u00a0access the contents of more than 3,000 mobile devices in the first half of the\u00a0fiscal year, despite having legal authority to access the data.<\/p>\n

The FBI was involved in a high profile battle with Apple last year<\/a>\u00a0when it went to court to try\u00a0to force the company\u00a0to weaken\u00a0its security system to help investigators\u00a0gain access to\u00a0a locked iPhone. Apple resisted and in the end\u00a0the FBI paid a third party company to hack into the device. But the bureau\u00a0appears eager to push for legislation to outlaw end-to-end\u00a0encryption (i.e. where service providers don\u2019t hold the encryption keys themselves).<\/p>\n

During last week\u2019s hearing Comey complained that a case-by-case\u00a0approach to breaking into\u00a0strongly encrypted devices and services does not scale, and backed fresh calls\u00a0by Senator Dianne Feinstein for\u00a0legislation to require companies decrypt data when served a warrant\u00a0\u2014 setting the scene for another round of crypto wars in the US.<\/p>\n

WhatsApp has been at the forefront of making\u00a0end-to-end encryption more accessible for mainstream app users, completing a rollout of\u00a0the tech across its platform and all flavors of its apps in April 2016<\/a>. It\u2019s also resisted legal attempts to strong arm it into handing over user data \u2014 such as in Brazil where its service has been blocked<\/a> multiple times as a penalty for its failure\u00a0to\u00a0provide decrypted data to\u00a0police. The company has maintained it cannot hand over information\u00a0it does not hold.<\/p>\n

Adding encryption to iCloud backups would appear to be a reinforcement of WhatsApp\u2019s\u00a0stance that user privacy is a necessity for data security. Albeit, one with a fair few\u00a0caveats<\/a> about how it has\u00a0implemented the security layer\u00a0here. Not enabling WhatsApp iCloud backups is a more perfect\u00a0fix for\u00a0avoiding the cloud storage vulnerability loophole, though one that might be inconvenient from the user\u2019s point of view.<\/p>\n","protected":false},"excerpt":{"rendered":"

\"\" WhatsApp has quietly beefed up the security of an iCloud backup feature for users of its messaging service — potentially closing a loophole that could enable otherwise end-to-end encrypted messages to become accessible in a readable form. Read More<\/a><\/p>\n

\n<\/img><\/a> <\/img><\/a> <\/img><\/a> <\/img><\/a> <\/img><\/a> <\/img><\/a>\n<\/div>\n

\"\"\/ <\/p>\n","protected":false},"author":5817,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","footnotes":""},"categories":[25],"tags":[59,66,26],"class_list":["post-340371","post","type-post","status-publish","format-standard","hentry","category-technology","tag-media","tag-techcrunch","tag-technology"],"_links":{"self":[{"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/posts\/340371","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/users\/5817"}],"replies":[{"embeddable":true,"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/comments?post=340371"}],"version-history":[{"count":0,"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/posts\/340371\/revisions"}],"wp:attachment":[{"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/media?parent=340371"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/categories?post=340371"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/tags?post=340371"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}