More than a billion people send messages over WeChat and as per a new study recently, it discovered some security flaws in terms of the encryption system. While some applications use end-to-end encryption to prevent secret conversations from being read, WeChat’s messages can be viewed by its servers. Researchers now find some vulnerability in WeChat’s customised encryption that could leave users vulnerable to threats.
Weakened Encryption in WeChat
Scientists at the Citizen Lab of University of Toronto have established that WeChat is using a variation of the general security protocol named Transport Layer Security, or TLS 1.3. The new version of it is called MMTLS and it is actually made up of another layer of encryption called “Business-layer encryption,” which encrypts messages right before they are going to be sent.
While this does mean that there is extra security placed on this system, it does not have weaknesses in the design. The inner Business-layer encryption does not protect critical information, including user IDs and request information. MMTLS also uses predictable patterns of a type of deterministic initialization vectors (IVs) that can lead to compromised encryption security overall.
Missing Forward Secrecy
Another weakness with WeChat’s encryption is a lack of “forward secrecy.” Forward secrecy helps to secure later communications in cases where old encryption
[…]
Content was cut in order to protect the source.Please visit the source for the rest of the article.