6

This question is about any chat service that supports end-to-end encrypted group chats, for instance Signal, XMPP + OMEMO (closed group chats in particular), WhatsApp, and the like.

How do these services ensure that a hostile server admin does not add their own keys to any group chat that they wish to snoop on? What are the best practices?

It's possible to ensure that all current group members are at least notified of the intrusion in their client, but the intruder may still access all messages sent before they are noticed and kicked out.

tao_oat
  • 312
  • 1
  • 2
  • 10
  • The answers for closed systems (e.g. Whatsapp) may differ from those for open ones (e.g. XMPP) - there is nothing to prevent a malicious client from simply rebroadcasting messages that come in legitimately to another endpoint silently. This would be a distinct conversation, so no additional user to the group chat itself, just a single member whose client is compromised. – Matthew Dec 21 '18 at 13:39
  • Yes, that's true -- I'm curious about a malicious server admin, not a compromised client. – tao_oat Dec 21 '18 at 13:42
  • I edited my answer to add more appropriate details. – defalt Dec 24 '18 at 19:07

1 Answers1

6

It is possible for a server admin to silently add an infiltrator to group chats. But without letting the group to be notified, It's not possible well atleast in Signal protocol.

Signal is open-source so you can verify from the source that a message that someone has joined the group is shown on GUI. While what's app if pressurised by the government can choose to program it in a way that no message is shown on GUI if they add an infiltrator.

But that won't prevent the infiltrator from getting detected. It is because the group key exchange would still be visible. To add a member into a group, the group administrator sends a group management message to each group member which instructs them to send their own group key to the person group admin wants to add. Now if you observe the key exchange is already started to happen. This group management message also notifies the members visually so that they know that said person is now part of the group. This is where you see that message on GUI. Once that person is added, he generates his own group key and sends to every member of the group as a personal one-to-one pairwise encrypted message. Yet another time, key exchange can be seen.

The group key is not same for all. Each member has its own group key and everybody keeps list of group keys of each other. That's why it is very important to flush old group keys when someone leaves because former member has learnt group keys of every member.

In Signal app, server doesn't involve with group administration. Everything happens exactly that way except the fact that there is no admin in Signal and every member can send group management message to the group members.

But In WhatsApp, a group admin doesn't send group management message directly to the group members. It should have but they went out of specifications. Instead the group admin sends this message to the server, the server verifies if he is actually an admin and then it instructs group members for key exchange. Actually, now WhatsApp sends group management message to only subset of members but it is enough, other members can send their group keys later. Even if the infiltrator is silently added by WhatsApp server, each member has to be instructed to prepare for the key exchange else the infiltrator won't be able to decipher the messages.

A team of crytopgraphers from Germany’s Ruhr University Bochum say they have uncovered flaws in WhatsApp’s security that could Let an Infiltrator Add Members to Group Chats

The described weaknesses enable attacker, who controls the WhatsApp server or can break the transport layer security, to take full control over a group. Entering the group however leaves traces since this operation is listed in the graphical user interface. The WhatsApp server can therefore use the fact that it can stealthily reorder and drop messages in the group.

In a response to the story, Moxie Marlinspike, co-founder of Open Whisper Systems, which developed the end-to-end encryption used in Signal and WhatsApp, refutes the researchers’ claim that an attacker could conceal alerts from other chat members that someone was added to a group. “The attacker will not see any past messages to the group; those were e2e encrypted with keys the attacker doesn’t have,” Marlinspike writes, adding, “All group members will see that the attacker has joined. There is no way to suppress this message.”

The attacker has joined message cannot be dropped because it is just not a message on GUI, it's an instruction for key exchange.

But let's suppose that the message was dropped and the infiltrator has joined the group without triggering any alert. Now if the group starts talking in his presence, all the infiltrator can see encrypted messages that are encrypted by the group key he never had which is same as sitting on the server and watching the passing messages. Without participating in the key exchange, group keys cannot be shared.

It doesn't matter how apps handles group management. If they are using E2E, a key exchange is always visible before communication can take place.

Theoretically it is still possible to verify if someone has been added without being notified by verifying whether a new group key is added. The group keys are only added or removed when someone leaves or enters the group.

if there is a backdoor added by the developer, then the app is compromised anyway so it is just not limited to silently adding an infiltrator. An adversary can then steal unencrypted received messages, private keys and group kety. The above detection method only lasts as long as the app itself is not compromised.

There are some concerns about group management in E2E protocol. You can read in this article, WhatsApp, Signal group chats not as secure as users might believe. Parent article has some more information about this problem

Technical talk from the Real World Crypto conference has also highlighted the problem with handling of group management in WhatsApp and Signal: On the end to end security of group chats | Paul Rösler (U. Bochum) | RWC 2018

You can also read their paper

WhatsAppp whitepaper has in-depth technical explanation of how key exchange for group chats is performed, pdf warning](https://www.whatsapp.com/security/WhatsApp-Security-Whitepaper.pdf).

I'm not sure about how other e2e protocols handles group management. Signal is the most popular one and widely tested.

Community
  • 1
defalt
  • 6,231
  • 2
  • 22
  • 37
  • 1
    `All the infiltrator can see encrypted messages that are encrypted by the group key he never had which is same as sitting on the server and watch the passing messages.` - Uh, what? If the attacker never had the keys, how can they read the previous messages? Shouldn't that be something like, "All the infiltrator can see is new messages encrypted with the new group key, as he never had the old one"? Although note that if I was adding a back door to my own app, I wouldn't bother suppressing signals - I'd just silently open up another conversation to another "user". – Clockwork-Muse Dec 21 '18 at 23:53
  • 1
    @Clockwork-Muse The attacker cannot read previously sent messages. If he joins the group without participating in key exchange he won't be able to read current messages unless each group member agrees on a new group key. I edited it. If they agree, the intrusion will be detected. – defalt Dec 22 '18 at 05:47