1 of 55

Cyber Saiyan�www.cybersaiyan.it

2200

600

1500

750

600

2 of 55

im irl

TL;DR instant messengers in real life

Cyber Saiyan

www.cybersaiyan.it

3 of 55

di cosa parliamo

app di messaggistica

💁‍♀️

🙋‍♂️

🙆

🎊

👨‍🎤

🦸‍♀️

💂‍♀️

🏢

4 of 55

di cosa parliamo

  • il cambio di policy di WhatsApp

  • è solo una questione legale o anche tecnica?

  • threat modeling nelle app IM

5 of 55

who? Gerardo Di Giacomo

security engineer @ stripe

sicurezza informatica dal 2002

membro Cyber Saiyan

@gedigi

⚠️ DISCLAIMER ⚠️�ex security engineer @ Signal messenger�ex security engineer @ WhatsApp

6 of 55

who? TheZero

security researcher @ Shielder SRL

ex-maintainer KeePassXC && ex-contributor F-Droid

ctf player in pensione (jbz, pequalsnp...)

7 of 55

who? Enrico Ferraris

avvocato

data Protection & Freedom of Information

“background tecnico”

@ebobferraris

8 of 55

Cambio Policy di WhatsApp

9 of 55

WhatsApp invierà i dati a facebook! (2021)

10 of 55

WhatsApp diventerà a pagamento!(2017)

11 of 55

cosa è previsto in Europa...

“Today, Facebook does not use your WhatsApp account information to improve your Facebook product experiences or provide you more relevant Facebook ad experiences on Facebook. This is a result of discussions with the Irish Data Protection Commission and other Data Protection Authorities in Europe. We're always working on new ways to improve how you experience WhatsApp and the other Facebook Company Products you use. Should we choose to share such data with the Facebook Companies for this purpose in the future, we will only do so when we reach an understanding with the Irish Data Protection Commission on a future mechanism to enable such use. We'll keep you updated on new experiences we offer and our information practices.”

12 of 55

...e nel resto del mondo

“As part of the Facebook Companies, WhatsApp receives information from, and shares information with, the other Facebook Companies. We may use the information we receive from them, and they may use the information we share with them, to help operate, provide, improve, understand, customize, support, and market our Services and their offerings, including the Facebook Company Products. This includes:�- improving their services and your experiences using them, such as making suggestions for you (for example, of friends or group connections, or of interesting content), personalizing features and content, helping you complete purchases and transactions, and showing relevant offers and ads across the Facebook Company Products”

13 of 55

cosa era previsto prima?

Facebook and the other companies in the Facebook family also may use information from us to improve your experiences within their services such as making product suggestions (for example, of friends or connections, or of interesting content) and showing relevant offers and ads.

(Privacy Policy del 25/08/2016, opt-out fino al 24/09/2016)

valida anche in Europa fino al 25/05/2018

14 of 55

su cosa può basarsi un trattamento?

a) consent [...] for one or more specific purposes;

b) for the performance of a contract [...];

c) for compliance with a legal obligation [...];

d) in order to protect the vital interests of the data subject [...];

e1) for the performance of a task carried out in the public interest;

e2) in the exercise of official authority vested in the controller;

f) for the [...] legitimate interests pursued by the controller [...]

(GDPR art. 6)

15 of 55

consenso ToS ≠ consenso al trattamento

“We may amend or update these Terms. Unless otherwise required by law, we will provide you at least 30 days' notice of amendments to our Terms, which will give you the opportunity to

review the revised Terms before continuing to use our Services. [...] Your continued use of our Services following the notice period of planned changes confirms your acceptance of our Terms, as amended.

We hope you will continue using WhatsApp, but if you do not agree to our Terms, as amended, you must stop using our Services by deleting your account.”

16 of 55

quali trattamenti basati sul consenso?

For collecting and using information you allow us to receive through the device-based settings you enable (such as access to your location, camera, or photos), so we can provide the services described when you enable the settings; for example, sharing your device’s precise location information if you are using our location features to share your location with your contacts or accessing your camera or photo gallery if you choose to share photographs or media with your contacts.”

gli altri trattamenti si fondano sull’esecuzione del contratto e sul legittimo interesse

17 of 55

quando Facebook tratta dati di Whatsapp

  1. “As part of the Facebook Companies, WhatsApp receives information from, and shares information with, the other FC to promote safety, security and integrity across the Facebook Company Products, e.g., to fight spam, threats, abuse, or infringement activities.”
  2. WhatsApp also works, and shares information with the other Facebook Companies who act on our behalf to help us operate, provide, improve, understand, customise, support, and market our Services. [...] When we receive services from the Facebook Companies, the information we share with them is used on WhatsApp’s behalf and in accordance with our instructions. Any information WhatsApp shares on this basis cannot be used for the Facebook Companies’ own purposes.”

18 of 55

quando Facebook tratta dati di Whatsapp

  1. “Businesses you interact with using our Services may provide us with information about their interactions with you. We require each of these businesses to act in accordance with applicable law when providing any information to us. When you message with a business on WhatsApp, it’s important to keep in mind that the content you share may be visible to several people in that business. In addition, some businesses might be working with third-party service providers (which may include Facebook) to help manage their communications with their customers. For example, a business may give such third-party service provider access to its communications to send, store, read, manage or otherwise process them for the business.”

19 of 55

flusso dati user-user vs user-business

“To understand how a business processes your information, including how it might share your information with third parties or Facebook, you should review that business’ privacy policy or contact the business directly.”

💁‍♀️

🙋‍♂️

🏢

💁‍♀️

controller

controller

processor

data subj.

data subj.

data subj.

processor

ℹ️ 📄

ℹ️ 📄

20 of 55

Questione Legale o anche Tecnica?

21 of 55

cosa ha richiesto il cambio di policy?

“WhatsApp Security Whitepaper” v3 - Ottobre 2020

https://www.whatsapp.com/security/WhatsApp-Security-Whitepaper.pdf

22 of 55

cosa ha richiesto il cambio di policy?

  • rimozione di WindowsPhone e aggiunta di KaiOS tra i client che supportano end-to-end encryption

  • rimozione della frase “At no time does the WhatsApp server have access to any of the client’s private keys.

  • aggiunta di 4 nuovi capitoli “Defining End-to-End Encryption”, “Implementation on WhatsApp Services”, “Encryption Has No Off Switch” and “Displaying End-to-End Encryption Status

23 of 55

definizione di end-to-end encryption

End-to-end encryption is a system of communication where

the only people who can read the messages are the people communicating. No eavesdropper can access the cryptographic keys needed to decrypt the conversation—not even a company that runs the messaging service.

Hacker Lexicon, Wired, 2014

💁‍♀️

📃🔑

🕵️‍♀️

🙋‍♂️

📃🔑

24 of 55

definizione di end-to-end encryption

End-to-end encryption is a system of communication where

the only people who can read the messages are the people communicating. No eavesdropper can access the cryptographic keys needed to decrypt the conversation—not even a company that runs the messaging service.

Hacker Lexicon, Wired, 2014

💁‍♀️

📃🔑

🕵️‍♀️

🙋‍♂️

📃🔑

🚫

25 of 55

user to user

26 of 55

user to business (WhatsApp Business API)

27 of 55

user to business (WhatsApp Business API)

  • il commerciante gestisce on-premise la propria istanza WhatsApp Business API.

  • l’istanza agisce come un “client” e2e verso l’utente, ed espone le API tramite endpoint HTTP(S).

  • memorizza i contenuti in un DB (locale).

28 of 55

user to business (via Facebook partner)

29 of 55

user to business (esempio Zendesk)

30 of 55

user to business (gestito da Facebook)

In 2021, organizations who use the Business API will be able to designate WhatsApp’s parent company, Facebook, as the vendor that operates the Business API endpoint on their behalf. Since such messages are not delivered directly to an endpoint controlled by the organization, WhatsApp does not consider chats with organizations who choose to use Facebook to operate their API endpoint to be end-to-end encrypted.

31 of 55

encryption has no off switch

The WhatsApp server has no access to the client’s private keys, though if a business user delegates operation of their Business API client to a vendor, that vendor will have access to their private keys - including if that vendor is Facebook.

32 of 55

displaying end-to-end encryption status

Across all our services, WhatsApp makes the end-to-end encryption status of a chat clear. If the user’s phone sees that it’s communicating with an API endpoint that delegates operation of its API to a vendor, the phone will display this to the user. The user can also double check the encryption status within the chat or in the business info section of their app.

These changes will take effect in all WhatsApp versions after January 2021.

33 of 55

displaying end-to-end encryption status

l’utente riceve delle “notifiche”/avvertimenti quando:

  • avvia una chat e2ee con un nuovo contatto
  • avvia una chat con un’utenza Business
  • lo stato e2ee della chat con un’utenza Business
  • un contatto cambia telefono (chiavi di cifratura/codice di sicurezza)

34 of 55

35 of 55

Threat Modeling

36 of 55

threat modeling

“analyzing representations of a system to highlight concerns about security and privacy characteristics”

threatmodelingmanifesto.org

37 of 55

architettura tipica app

mobile app

server storage

server

backup

mobile storage

backup storage

💁‍♀️

💁‍♀️

38 of 55

architettura tipica app

mobile app

server storage

server

backup

mobile storage

backup storage

💁‍♀️

💁‍♀️

39 of 55

WhatsApp

mobile app

server storage

server

backup

mobile storage

backup storage

metadati

contenuti

💁‍♀️

💁‍♀️

40 of 55

WhatsApp

mobile app

server storage

server

backup

mobile storage

backup storage

💁‍♀️

💁‍♀️

metadati

contenuti

41 of 55

WhatsApp

mobile app

server storage

server

backup

mobile storage

backup storage

💁‍♀️

💁‍♀️

metadati

contenuti

42 of 55

WhatsApp consumer

server

mobile app

💁‍♀️

mobile app

💁‍♂️

contenuti

43 of 55

WhatsApp business via facebook

server

mobile app

💁‍♀️

wa biz app

contenuti

44 of 55

Telegram

mobile app

server storage

server

backup

mobile storage

backup storage

metadati

contenuti

💁‍♀️

💁‍♀️

45 of 55

Telegram

mobile app

server storage

server

backup

mobile storage

backup storage

metadati

💁‍♀️

💁‍♀️

contenuti

46 of 55

Telegram chat segrete

mobile app

server storage

server

backup

mobile storage

backup storage

💁‍♀️

💁‍♀️

metadati

contenuti

47 of 55

Telegram

mobile app

server storage

server

backup

mobile storage

backup storage

metadati

💁‍♀️

💁‍♀️

contenuti

48 of 55

Signal

mobile app

server storage

server

backup

mobile storage

backup storage

metadati

contenuti

💁‍♀️

💁‍♀️

49 of 55

Signal

mobile app

server storage

server

backup

mobile storage

backup storage

💁‍♀️

💁‍♀️

metadati

contenuti

50 of 55

Signal

mobile app

server storage

server

backup

mobile storage

backup storage

metadati

💁‍♀️

💁‍♀️

contenuti

51 of 55

protezione contenuti

messaggi e2ee

messaggi e2ee

messaggi e2ee

chiamate a/v e2ee

chiamate a/v e2ee

chiamate a/v e2ee

backup locale

no backup

backup cifrato

solo chat segrete

media in chiaro su android

solo chat segrete

52 of 55

protezione metadati

localizzazione precisa e2ee

localizzazione precisa e2ee

localizzazione precisa e2ee

private contact discovery

numero non visibile (username)

secure value recovery

sealed sender

solo chat segrete

53 of 55

54 of 55

Your choice

55 of 55

Question time

Questions?