A more dramatic revelation of 2018—an outsider can secretly eavesdrop on your private end-to-end encrypted group chats on WhatsApp and Signal messaging apps. Considering protection against three types of attackers—malicious user, network attacker, and malicious server—an end-to-end encryption protocol plays a vital role in securing instant messaging services.
The primary purpose of having end-to-end encryption is to stop trusting the intermediate servers in such a way that no one, not even the company or the server that transmits the data, can decrypt your messages or abuse its centralized position to manipulate the service.
In order words—assuming the worst-case scenario—a corrupt company employee should not be able to eavesdrop on the end-to-end encrypted communication by any mean.
However, so far even the popular end-to-end encrypted messaging services, like WhatsApp, Threema and Signal, have not entirely achieved zero-knowledge system.
Researchers from Ruhr-Universität Bochum (RUB) in Germany found that anyone who controls WhatsApp/Signal servers can covertly add new members to any private group, allowing them to spy on group conversations, even without the permission of the administrator.
As described by the researchers, in the pairwise communication (when only two users communicate with each other) server plays a limited role, but in case of multi-user chats (group chat where encrypted messages are broadcasted to many users), the role of servers increases to manage the entire process.
That's where the issue resides, i.e. trusting the company's servers to manage group members (who eventually have full access to the group conversation) and their actions.
As explained in the newly published RUB paper, titled "More is Less: On the End-to-End Security of Group Chats in Signal, WhatsApp, and Threema," since both Signal and WhatsApp fail to properly authenticate that who is adding a new member to the group, it is possible for an unauthorized person—not a group administrator or even a member of the group—to add someone to the group chat.
What's more? If you are wondering that adding a new member to the group will show a visual notification to other members, it is not the case.
According to the researchers, a compromised admin or rogue employee with access to the server could manipulate (or block) the group management messages that are supposed to alert group members of a new member.
"The described weaknesses enable attacker A, who controls the WhatsApp server or can break the transport layer security, to take full control over a group. Entering the group, however, leaves traces since this operation is listed in the graphical user interface. The WhatsApp server can therefore use the fact that it can stealthily reorder and drop messages in the group," the paper reads.
"Thereby it can cache sent messages to the group, read their content first and decide in which order they are delivered to the members. Additionally, the WhatsApp server can forward these messages to the members individually such that a subtly chosen combination of messages can help it to cover the traces."
WhatsApp has acknowledged the issue, but argued that if any new member is added to a group, let's say by anyone, other group members will get notified for sure.
"We've looked at this issue carefully. Existing members are notified when new people are added to a WhatsApp group. We built WhatsApp so group messages cannot be sent to a hidden user," a WhatsApp spokesperson said.
"The privacy and security of our users is incredibly important to WhatsApp. It's why we collect very little information and all messages sent on WhatsApp are end-to-end encrypted."
But if you are not part of a group with very selected members, I'm sure many of you would relatively ignore such notifications easily.
Researchers also advised companies to fix the issue just by adding an authentication mechanism to make sure that the "signed" group management messages come from the group administrator only.
However, this attack is not easy (exception—services under legal pressure) to execute, so users should not be worried about it.
totally ugly—but even in its rudimentary form, we were impressed with what they could do. The glasses show information in the corner of the lens, including surprisingly reliable facial recognition tech that tells you who's around. It's a compelling proof of concept of what AR wearables will be capable of before 2018 is over.
electronics firm Teenage Engineering. Even more fun, Raven is owned by Chinese web services giant Baidu, so when you talk to the little LED-dotted square on top, you’re interacting with DuerOS, Baidu’s rapidly growing AI platform. There’s just one catch: You’ll need to talk to it in Chinese.
Bluetooth, and sticks to your windshield. From its perch, this round gizmo provides a dash cam, turn-by-turn navigation, and all of Alexa's many other skills. If you connect it to your stereo (again over Bluetooth), you can even use your voice to control your music. It's not quite as simple as an integrated setup, but at $230 it won't require a bank loan just to get one.
hay: Turn off the lights. Tick the thermostat down a few notches. Set the home security system. Set your phone to "do not disturb" mode. While you snooze, it also tracks sleep cycles, heart rate, and snoring patterns through a thin pad that slips under the mattress.
it. If it ever comes out (and that’s a long shot), it will cost somewhere in the neighborhood of $16,000. But in a tech conference filled with a lot of genuinely useless ideas, at least Laundroid is trying to make life legitimately easier. The company even says that it’s partnering with a laundry machine maker so a future Laundroid can actually launder your clothes too.
about it more holistically, developing a set of gadgets that work together to actually help out pets and their owners. Its smart collar tracks your pooch anywhere it goes, but it also acts as an ID, telling the Wagz smart feeder how much food to spit out. And when your mutt walks over to the Wagz smart door, it'll only open if it's the right dog and the right time. You can manage all your pets' schedules on your phone, or just open up the feeder if you're going to be home a few minutes late.
It’s small enough to throw into a purse, great-looking, and so quiet and discreet that a pumping mom had it running inside her shirt at a CES demo. And we had no idea.
exception. It’s light, attractive, versatile, easy to navigate, and can turn a huge amount of data—like your heart rate and V02 max—into a personalized 10-day training plan.
and the day’s precipitation (or lack thereof). If you find that poring over this information is a satisfying task, more power to you. But if you’d like to eliminate the guesswork, save water, and optimize your tomato growth, Scott’s smart irrigation system can help. It tailors your watering schedule to satellite weather updates, soil conditions, and plant variety, and can be monitored from your smartphone.
Nvidia graphics) that’s always kept up-to-date on the backend. So, instead of popping in a new graphics card or upping the RAM, you just keep paying $35 per month and the upgrades are included. The company’s compact $135 Shadow Box will let you turn any monitor, PC, and mouse into a system hardcore enough to run games at up to 4K/60.
