WhatsApp implements encryption by default on Android OS

WhatsApp implemented the encryption by default on Android OS with the collaboration of the Open Whisper company. Soon it will be extended to other platforms.

Many time security community has discussed about security of the popular messaging application WhatsApp, early 2014 experts at Praetorian discovered different security issues in the way WhatApp implements SSL, the principal one is the lack of enforcing the “certificate pinning“ which exposed users to the risk of man-in-the-middle attacks, but the company after different alert fixed the flaws.

Another bug discovered in WhatsApp app exposed user’s location to attackers, in particular under analysis there was the WhatsApp “Location Share” feature.

The company intends to demonstrate the importance it assigns to user security and privacy, it recently added end-to-end encryption for some mobile clients. Probably the decision to improve security of communication is for the company a need after the revelation made by the whistleblower Edward Snowden on the surveillance activities of the NSA.

The improvement was possible thanks the collaboration with the Open Whisper Systems mobile security firm, started by the popular security researcher Moxie Marlinspike. It was 2011 when Twitter acquired Open Whisper Systems, Marlinspike worked with them for two years before leaving.

The encryption implemented in the WhatsApp client is available only for Android OS and only could be used only for direct messages and not group messages.

“The most recent WhatsApp Android client release includes support for the TextSecure encryption protocol, and billions of encrypted messages are being exchanged daily. The WhatsApp Android client does not yet support encrypted messaging for group chat or media messages, but we’ll be rolling out support for those next, in addition to support for more client platforms. We’ll also be surfacing options for key verification in clients as the protocol integrations are completed,” states Open Whisper Systems in a blog post.

Probably the decision to improve security of communication is for the company a need after the revelation made by the whistleblower Edward Snowden on the surveillance activities of the NSA.

Security experts consider the introduction of encryption for the WhatsApp a significant effort due to the huge volume of messages elaborated by the server of the company every day, more than a billion messages will protected by the encryption by the firm.

“The most recent WhatsApp Android client release includes support for the TextSecure encryption protocol, and billions of encrypted messages are being exchanged daily. The WhatsApp Android client does not yet support encrypted messaging for group chat or media messages, but we’ll be rolling out support for those next, in addition to support for more client platforms.” states Open Whisper.

The company revealed that the deployment of the encryption features for WhatsApp will be extended incrementally also to other OSs that support the popular messaging application.

“WhatsApp runs on an incredible number of mobile platforms, so full deployment will be an incremental process as we add TextSecure protocol support into each WhatsApp client platform. ” said Open Whisper

The blog post also confirmed that the experts at Open Whisper company are continuing to develop their TextSecure app, to extend it to hundreds of millions of users.

[adrotate banner=”9″]

Pierluigi Paganini

(Security Affairs –WhatsApp, mobile)

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.