WhatsApp exploit lets hackers manipulate group chat messages

Researchers say the flaw could be used to spread fake news across the platform

WhatsApp, Web app, Messaging

Researchers have uncovered a vulnerability in WhatsApp's encryption method that can allow malicious actors to manipulate messages and user identities in group chats, with the fear that this could be used to spread fake messages and news.

All messages sent through the service are secured via end-to-end encryption meaning not even WhatsApp is able to see them. But a team from Check Point Research discovered three methods of attack that can be derived from reversing this encryption process, and then accessing the decrypted communications data.

Using the 'quote' feature in a group chat, hackers can change the identity of a sender, alter the text of a previously sent message, and send a private message to a group member disguised as a public message meaning their response (to what they believe is a private message) will be made public.

WhatsApp has denied this is a vulnerability, and insists end-to-end encryption remains safe.

"WhatsApp, has over 1.5 billion users with over one billion groups and 65 billion messages sent every day. With so much chatter, the potential for online scams, rumours and fake news is huge," Check Point Research's Dikla Barda, Roman Zaikin and Oded Vananu wrote in a blog post.

Advertisement
Advertisement - Article continues below
Advertisement - Article continues below

"It doesn't help then, if threat actors have an additional weapon in their arsenal to leverage the platform for their malicious intentions."

"Following the process of Responsible Disclosure, Check Point Research informed WhatsApp of their findings. From Check Point Research's view, we believe these vulnerabilities to be of the utmost importance and require attention."

After decrypting WhatsApp messages and accessing them via the web, the researchers were able not only to see the individual parameters that make up the messages i.e. the sender name, message content, recipient name, etc but manipulate these fields.

In one example, researchers were able to change a message posted in a group chat from a link to an article recommending "great health tips", to a message that read "guys I just heard product X can cause illness in children. I will not be buying it anymore!!" using the quote feature.

The researchers also developed a version of the tool they used to demonstrate the exploits that users can download for free via Github.

Advertisement - Article continues below

WhatsApp's use of end-to-end encryption, fully employed since 2016, has drawn the ire of national governments and security agencies, who argue the messaging app can be used by extremists to plot terrorist attacks without being traced.

Crucially, because the nature of this form of encryption means WhatsApp doesn't store any of the data sent using the app, it's difficult to see how messaging service to verify or cross-reference suspected fake messages with 'originals' if they are manipulated using methods such as those deployed by Check Point Research.

"We carefully reviewed this issue and it's the equivalent of altering an email to make it look like something a person never wrote," a WhatsApp spokesperson said.

"This claim has nothing to do with the security of end-to-end encryption, which ensures only the sender and recipient can read messages sent on WhatsApp.

"We take the challenge of misinformation seriously and recently placed a limit on forwarding content, added a label to forwarded messages, and made a series of changes to group chats.

Advertisement
Advertisement - Article continues below

"We ban accounts that attempt to modify WhatsApp to engage in spammy behavior and we are working with civil society in several countries to educate people about fake news and hoaxes."

Advertisement - Article continues below

The spokesperson added that to make the changes Check Point Research suggested, WhatsApp would be required to log all messages - which it was not prepared to do for the sake of user privacy - or severely limit the functionality of group chats.

Featured Resources

Digitally perfecting the supply chain

How new technologies are being leveraged to transform the manufacturing supply chain

Download now

Three keys to maximise application migration and modernisation success

Harness the benefits that modernised applications can offer

Download now

Your enterprise cloud solutions guide

Infrastructure designed to meet your company's IT needs for next-generation cloud applications

Download now

The 3 approaches of Breach and Attack Simulation technologies

A guide to the nuances of BAS, helping you stay one step ahead of cyber criminals

Download now
Advertisement

Recommended

Visit/security/internet-security/354417/avast-and-avg-extensions-pulled-from-chrome
internet security

Avast and AVG extensions pulled from Chrome

19 Dec 2019
Visit/security/354156/google-confirms-android-cameras-can-be-hijacked-to-spy-on-you
Security

Google confirms Android cameras can be hijacked to spy on you

20 Nov 2019

Most Popular

Visit/operating-systems/25802/17-windows-10-problems-and-how-to-fix-them
operating systems

17 Windows 10 problems - and how to fix them

13 Jan 2020
Visit/microsoft-windows/32066/what-to-do-if-youre-still-running-windows-7
Microsoft Windows

What to do if you're still running Windows 7

14 Jan 2020
Visit/web-browser/30394/what-is-http-error-503-and-how-do-you-fix-it
web browser

What is HTTP error 503 and how do you fix it?

7 Jan 2020
Visit/policy-legislation/general-data-protection-regulation-gdpr/354577/data-protection-fines-hit-ps100m
General Data Protection Regulation (GDPR)

Data protection fines hit £100m during first 18 months of GDPR

20 Jan 2020