• umami_wasabi@lemmy.ml
      link
      fedilink
      English
      arrow-up
      54
      arrow-down
      1
      ·
      4 months ago

      A French and Dutch Joint Investigation Team (JIT) harvested more than 115 million supposedly encrypted messages from an estimated 60,000 users of EncroChat phones after infecting the handsets with a software “implant”.

      Looks like they just hack the phone

      • Otter@lemmy.ca
        link
        fedilink
        English
        arrow-up
        26
        ·
        edit-2
        4 months ago

        https://en.m.wikipedia.org/wiki/EncroChat

        So this sounds like the ANOM phone story with extra steps?

        I get that they can “access” messages, but the headline feels misleading if it requires full access to the device.

        It’s not that they’re breaking encryption or reading messages in transit, it’s more like they’re installing malware on specific devices so that they can look at your screen?

        • sunzu@kbin.run
          link
          fedilink
          arrow-up
          2
          ·
          4 months ago

          Because truth is more complex and does nor drive clicks. so far every time we see signal in a headline like this, it will generally be “cops had physically access” “no password” or “password leaked”

          ie something that encryption is not designed to defend against.

      • Einar@lemm.ee
        link
        fedilink
        English
        arrow-up
        3
        arrow-down
        1
        ·
        4 months ago

        How does one get an “implant” onto a phone?

    • RmDebArc_5@sh.itjust.works
      link
      fedilink
      English
      arrow-up
      23
      ·
      4 months ago

      Apparently what happened is that French police installed some of malware on the phones to read the messages, and this was now decided to be legal in the UK.

            • Björn Tantau@swg-empire.de
              link
              fedilink
              English
              arrow-up
              6
              ·
              4 months ago

              The basic security stuff exists on Android and iOS as well, namely full disk encryption. When that is defeated through a missing or bad password nothing keeps them from installing their malware with device access.

              If they got in through an external security vulnerabilities in some software package the situation is also the same on either OS.

          • linearchaos@lemmy.world
            link
            fedilink
            English
            arrow-up
            1
            ·
            4 months ago

            What would that change?

            To be honest, it ‘could’ change everything. You don’t need to run ‘phone’ hardware. You could assemble a handled computer with a 5G modem out of consumer-available parts.

            Even if we didn’t go that far, we would get our own LUKS encryption with keys we chose and if we knew we couldn’t trust the hardware, we could take precautions. They can attack apple and android easily enough because it’s just two platforms, one vulnerability in android and you’re into 50% of the population.

            While we at it with wishlists, maybe we could do some hardware version of tpm/dpapi and manage to relatively safely encrypt the ram as well.

    • pwalker@discuss.tchncs.de
      link
      fedilink
      English
      arrow-up
      7
      ·
      4 months ago

      Honestly mentioning Enchrochat together with other mainstream message clients is kind of misleading. The Enchrochat message client was also E2EE. However Enchrochat was also a company that sold their own mobile phones with a prorietary OS on it together with own sim cards and only those phones were able to connect to each other. And law enforcment had enough evidence that they sold those hardware in shady untracable ways similar to drugs. At that point there was no western government that didn’t want to help seizing their infrastructure and taking over their update services for example.

      The bigger problem however for the general public is that certain politicians want to break encryption all together by forcing companies to implement backdoors on client side. This has been an ongoing discussion for 2 years in EU parliament and it has to stop: https://www.eff.org/deeplinks/2024/06/now-eu-council-should-finally-understand-no-one-wants-chat-control

      • conciselyverbose@sh.itjust.works
        link
        fedilink
        English
        arrow-up
        1
        ·
        4 months ago

        And law enforcment had enough evidence that they sold those hardware in shady untracable ways similar to drugs

        It doesn’t matter. Using that phone or app cannot possibly be anywhere close to probable cause for a search.

    • Lucy :3@feddit.org
      link
      fedilink
      English
      arrow-up
      5
      ·
      4 months ago

      Especially with Signal being open source. What stops the official Signal company from advertising another fork?

          • Lucy :3@feddit.org
            link
            fedilink
            English
            arrow-up
            9
            arrow-down
            1
            ·
            4 months ago

            There’s a grain of truth in the claim: We don’t know for sure if the original open source version is actually running on the server.

            • bamboo@lemmy.blahaj.zone
              link
              fedilink
              English
              arrow-up
              4
              ·
              4 months ago

              They’ve said that they release the source code after it’s running in production:

              sorry the source for one of our services was so far behind. We often don’t push source until we release things, and there were a few overlapping releases that happened in that period which made it awkward to push at any moment and put us behind. Additionally, we’ve seen a large increase in spam, and a reluctance to immediately publish the exact anti-spam measures we were responding with to a place where spammers could immediately see them combined with the above to cause this extreme delay.

              https://github.com/signalapp/Signal-Android/issues/11101#issuecomment-815400676

          • einkorn@feddit.org
            link
            fedilink
            English
            arrow-up
            6
            ·
            4 months ago

            In that case: They started publishing code AGAIN.

            The server soft has been available, then not, and apparently now again.

        • Lucy :3@feddit.org
          link
          fedilink
          English
          arrow-up
          4
          ·
          4 months ago

          That’d be irrelevant, because as long as only the clients hold the keys (which we can verify, as those are not only open source but also are under our control, meaning we can check that the upstream open source version is installed and no private keys are being exchanged) there’s no way anyone can read the messages, except the owner of the private key.

          • EngineerGaming@feddit.nl
            link
            fedilink
            English
            arrow-up
            2
            ·
            4 months ago

            Messages - yes, but there is also metadata. When ALL communication goes through the same servers, it becomes kind of a problem.

    • redditReallySucks@lemmy.dbzer0.com
      link
      fedilink
      English
      arrow-up
      6
      arrow-down
      1
      ·
      4 months ago

      With a warrant they could probably force signal/whatsapp to inject Malware into their apps to spy on users.

      Don’t know how possible it is with signal and their reproducible builds. They would need to add this to the source code of the app.

    • Routhinator@startrek.website
      link
      fedilink
      English
      arrow-up
      2
      ·
      edit-2
      4 months ago

      WhatsApp has MITM on the server side which is how Facebook scans your messages for targeted adverts. E2EE on WhatsApp was a fantasy the moment Facebook bought it

      That is different than Signal which (unless they changed something with the profiles thing) was always P2P E2EE. You’re sending encrypted messages directly to the other persons phone, not to a server.