Dodgy pics sneak into WhatsApp web

Web version of WhatsApp messenger was at risk from malicious files

A single dodgy image could let attackers read your WhatsApp messages but only through the browser-based version of the messaging app.

Security firm Check Point spotted the flaw in Facebook-owned WhatsApp and Telegram, though it only affects the web-based versions of those tools, not the mobile apps themselves. It's triggered by sending a malicious file, such as a photo.

"This vulnerability, if exploited, would have allowed attackers to completely take over users' accounts on any browser, and access victims' personal and group conversations, photos, videos and other shared files, contact lists, and more," noted Check Point's researchers in a blog post. "This means that attackers could potentially download your photos and or post them online, send messages on your behalf, demand ransom, and even take over your friends' accounts."

To use the flaw, attackers would send a file to the target that looked innocent but contained malicious code, which opens up access to let the hacker grab data. It takes advantage of WhatsApp's encryption, which protects an image from being viewed without validating it first. That means the malicious file can sneak through.

"Since messages were encrypted without being validated first, WhatsApp and Telegram were blind to the content, thus making them unable to prevent malicious content from being sent," Check Point's researchers noted.

The flaw was reported to WhatsApp and Telegram on 7 March, with a patch already rolled out. Anyone using the web version of either messaging app should make sure they restart the browser to ensure they are using the latest version.

Director of the Kent Cyber Security Centre, Eerke Boiten, agreed, saying it was worth stressing it's not encryption that's at issue, but malicious files.

"That they cannot be spotted is being blamed on the fact that they're encrypted - but spotting malicious files is an inexact science to start with; of course encryption does make it harder," he said. "WhatsApp say they will fix this by screening files for malicious content before they get encrypted and sent across; that seems sensible but imperfect."

Nevertheless, the fact malicious files hidden the way Check Point's researchers slipped them in was indeed a security design error, he said. "File previews could be just that, but it looks like they have used general web browser functionality for those, and thus allow code from inside a malicious file to actually attack the Whatsapp user's account," he added.

Boiten said it was similar to previous coverage of WhatsApp flaws, notably mention of the app in a tranche of CIA files leaked by Wikileaks. "The Wikileaks leak on CIA tools earlier had a completely gratuitous mention of WhatsApp: of course if you can control the device on which the encryption takes place, encryption itself has become pointless as you can grab the data before encryption takes place," he said. "That is not a flaw or even a 'circumvention' of the encrypted communication."

That doesn't mean the messaging service is perfectly secure, he noted. "Despite stories attacking WhatsApp for the wrong reasons, of course some caution regarding WhatsApp remains sensible," he said. "They may be encrypting the contents of communications, but the metadata of who messages whom (and when, and from where) is still visible to them. Such metadata is likely to be more useful than the content anyway, for their owners Facebook and other surveillance outfits."

Featured Resources

Preparing for AI-enabled cyber attacks

MIT technology review insights

Download now

Cloud storage performance analysis

Storage performance and value of the IONOS cloud Compute Engine

Download now

The Forrester Wave: Top security analytics platforms

The 11 providers that matter most and how they stack up

Download now

Harness data to reinvent your organisation

Build a data strategy for the next wave of cloud innovation

Download now

Recommended

New malware uses search engine ads to target pirate gamers
malware

New malware uses search engine ads to target pirate gamers

21 Jul 2021
WhatsApp launches multi-device beta with support for end to end encryption
communications

WhatsApp launches multi-device beta with support for end to end encryption

15 Jul 2021
IT Pro News in Review: VMware vulnerabilities, WhatsApp sues Indian government & UK PNC under fire
cyber security

IT Pro News in Review: VMware vulnerabilities, WhatsApp sues Indian government & UK PNC under fire

28 May 2021
HackBoss malware is using Telegram to steal cryptocurrency from other hackers
cryptocurrencies

HackBoss malware is using Telegram to steal cryptocurrency from other hackers

16 Apr 2021

Most Popular

RMIT to be first Australian university to implement AWS supercomputing facility
high-performance computing (HPC)

RMIT to be first Australian university to implement AWS supercomputing facility

28 Jul 2021
UK gov considers blocking Nvidia's takeover of Arm
Acquisition

UK gov considers blocking Nvidia's takeover of Arm

4 Aug 2021
Zyxel USG Flex 200 review: A timely and effective solution
Security

Zyxel USG Flex 200 review: A timely and effective solution

28 Jul 2021