Hi,
I was reading [this](https://www.businessinsider.com/passenger-faces-120k-fines-after-fighter-jets-scrambled-for-bomb-joke-2024-1?amp) article, in which some kid made a joke about bombing the plane to his friend/s over snapchat just before boarding. The message was intercepted by the intelligence agencies and some response military planes were sent to intercept the plane.
So the assumption is that airport network traffic is heavy sniffed and analysed by local intelligence agencies but based on the following facts:
– snapchat is end to end encrypted
– traffic goes over HTTPS
– he sent the message to his friend/s who clearly didn’t report him for a prank
How was the intelligence agency able to figure out the content of the message?
In: Technology
Some quick googling says to me that Snapchat’s encryption implementation sucks. They do E2E encryption for the pictures, but not for the text. This means the intermediary snapchat servers can inspect the text, and thus the authorities too.
There’s also apparently a problem where Snapchat doesn’t check for a chain of trust on the Certificate used by the central server, which means someone can spoof it and act as a central server like a Man in the Middle attack.
There’s also the possibility that there was something on either phone that was looking at the content. E2E encryption doesn’t protect from mishandling data at the ends.
And if you want to get conspiratorial, there’s some theories that the NSA has a backdoor into the Elliptic Curve ciphers that are in use in cryptography, because the NSA provided the specific elliptic curve that is used in cryptography libraries. [Here](https://www.youtube.com/watch?v=NF1pwjL9-DE)’s some more about EC.
I think the most likely explanation is snapchat had some keyword/AI based system and passed the information on to the authorities. Their E2E is spotty, and apparently doesn’t apply to team chats.
Sniffing the packets and breaking the encryption seems unlikely. Even if not E2E, the messages will be encrypted with TLS* to the snapchat servers. It’s certainly possible the government can break TLS, but if they can I think it’s very unlikely they’d risk revealing they can break it on a case of this size.
(*I mean, I assume they do, I haven’t done any packet sniffing to check it out. But at this point it’s almost easier to use TLS than not, and it would be baffling if they weren’t.)
> snapchat is end to end encrypted
This is your flawed reasoning. Snapchat employs E2EE for photographs but not for text.
I firmly believe the NSA has backdoors for RSA and elliptic curve algorithms just like China has backdoors for SM2.
End to End just encrypts the traffic while traversing the internet or certain servers.
It needs to be decrypted once the traffic reached its destination.
At this point this cleartext traffic can be read. Technically this cleartext can be send to any server without you knowing. Most Apps are closed source, so you don’t know what happens to your text or picture after your application decrypted it.
Mr Verma’s message was picked up by the UK security services who flagged it to Spanish authorities while the easyJet plane was still in the air.
A court in Madrid heard it was assumed the message triggered alarm bells after being picked up via Gatwick’s Wi-Fi network.
All from the original bbc story.
This raises an essential point, Why do you trust Snapchat? When you say “snapchat is end to end encrypted”, what makes you think that? You most likely don’t have the source code for Snapchat or the computer science background to analyze it for security vulnerabilities – almost nobody does. Instead you think that because Snapchat told you. You choose to trust them.
That choice could be wrong. They might have done a sloppy job, or made a deal with the intelligence community, there is no way for you to know.
What’s a user to do? Trust nobody. Never text something you don’t want the government to know. Never take a picture you don’t want posted on the Internet. Store your secrets on paper in a fireproof metal box, not on some unauditable software tool running on a computer connected to the Internet.
Imagine you have the world’s best safe no one but you know the code. You don’t know that there’s a tiny button on the back that unlocks the door.
Latest Answers