The rock-solid world of encrypted messaging has been shaken in recent days. A new FBI warning shows that end-to-end encryption does not protect phone users in the way most expect. That’s why Microsoft is finding WhatsApp messages delivering malware, and it’s why the bureau can harvest deleted Signal messages on a phone.
Put simply, while end-to-end encryption protects messages in transit, it does not protect user accounts or the devices messages are stored on or accessed from.
The bureau warns Russian spies are “targeting commercial messaging applications” without compromising their “encryption or the applications themselves.” WhatsApp, Signal and other platforms remain secure. Encryption remains intact. And yet users have still been compromised, including by the FBI itself.
The key point is this — most users assume end-to-end encryption is a catch-all that keeps their messaging content completely safe. It’s not. End-to-end encryption is transmission security. It protects content from when it leaves your device until it reaches the devices it’s being sent to. That content is decrypted on those devices — or “ends” — and is then protected by the device’s security.
That means a threat actor that physically or remotely compromises a phone can target access to secure content. There are more than 1 billion smartphones that are no longer eligible for OS security updates. That’s where the key threat lies. Every vulnerability found to be powering new attacks puts all those devices at risk.
The FBI’s extraction of deleted Signal messages had nothing to do with Signal — its security was intact. Instead it exploited the way in which iPhone stores notifications on a device. If you set Signal or WhatsApp or any other platform’s notifications to show the sender and a preview of the content, that data is at risk. Change your messaging and notification settings if that concerns you.
The other key vulnerabilities relate to messaging accounts — including the scourge of WhatsApp account hijacks — and multi-device access. If you’re tricked into sharing a security code or adding an attacker’s phone to your WhatsApp or Signal account, through a rogue link or QR code, they can eavesdrop on everything. You can — and should — check linked devices in your app to ensure all is as expected.
Per the FBI’s warning, despite end-to-end encryption remaining fully intact, this latest hacking campaign “resulted in unauthorized access to thousands of individual (messaging) accounts. After compromising an account, malicious actors can view the victims’ messages and contact lists, send messages.” While the bureau says on this occasion, “the threat actors specifically targeted Signal accounts,” they can “apply similar methods” against other messaging apps.
End-to-end encryption is fine, despite noisy posts from Elon Musk and others. But that end-to-end encryption does not in itself protect you. Your security is only as good as the phone you use — and the people you message.
End-to-end encryption (E2EE) is widely considered the gold standard for digital privacy, ensuring that only the sender and recipient can read messages. However, “Are you sure?” is a valid question because while the transmission is secure, the endpoints (the phones themselves) and metadata can still be vulnerable.
E2EE works as advertised for protecting message content from eavesdropping. However, it does not make you immune to user-level risks, compromised device security, or metadata sharing.
XStealth Phones provide the latest advanced security solution. Breakdown of hardware security specs:
Device Physical Access
Secure Battery
Secure Baseband
Secure Folder
Removed Cameras and Mics
Other Secure Hardware Features:
* Available only for XStealth PRO
Miscellaneous features (software-related)
Thank you,
A malware vendor has set up a fake website claiming to be from Amnesty International, offering gullible users software that purports to protect them from the NSO Group’s Pegasus malware. In reality it is a Remote Access Trojan (RAT).
Have you got an untraceable phone? We’ll help you test it! Do you really want to protect yourself? Read this article
Remember our warnings regarding VPN use and security flaws that all VPNs have? Now this: FBI warning: This zero-day VPN software flaw was exploited by APT hackers.
