End-to-end encryption makes spam filtering more difficult.
Spam sent through the
WhatsApp
messaging service is on the rise, mobile security firm
AdaptiveMobile
reports
.
This news should come as little surprise: any means by which messages can be spread quickly and cheaply has always been attractive to spammers, be that email, website comments or
Twitter
mentions. And just as many users have started to use
WhatsApp
and other
OTT
messaging apps as a replacement for SMS, so have spammers.
Google
searches for ‘WhatsApp spam’ have risen in recent years, just as searches for ‘SMS spam’ have decreased.
AdaptiveMobile
‘s Cathal McDaid also points to a recently implemented anti-spam law in India, which made the sending of SMS spam illegal. As a consequence, the amount of SMS spam in India dropped by 97% in 2014 alone, and services have sprung up in the country that allow people to send bulk
WhatsApp
messages for very little cost.
What makes this particularly interesting is that
WhatsApp
is in the process of
rolling out
end-to-end encryption for all its users (much to the
chagrin
of the UK prime minister).
This means that
WhatsApp
, or its parent company
Facebook
, can see who is sending messages to whom, but it can’t see what is actually inside the messages. The firm could thus stop someone from sending too many messages (thus driving up the cost for spammers), but it couldn’t even detect a large number of (compromised) devices sending the very same message — which is a pretty good indicator of an ongoing spam campaign.
Of course, it would still be possible for the
WhatsApp
app, or a third-party anti-spam app running on the device, to check the content of a message and block it if it is deemed spam. But sending parts of messages, such as URLs, to a central server to look for patterns and check these against blacklists – an important technique in the filtering of email spam – would give away essential information about the messages to third parties.
I applaud
WhatsApp
‘s decision to roll out end-to-end encryption and hope many other companies will follow suit. But, as with just about any measure that improves security and/or privacy, it comes at a cost. We’ll just have to become a bit more inventive in our fight against spam. And perhaps, if attempts to make more users use email encryption finally become successful, we will be able to use the lessons learned fighting
WhatsApp
spam to fight email spam in this much more restrictive environment.
Posted on 16 January 2015 by
Martijn Grooten
Leave a Reply