Dodgy pics sneak into WhatsApp web

Web version of WhatsApp messenger was at risk from malicious files

A single dodgy image could let attackers read your WhatsApp messages but only through the browser-based version of the messaging app.

Security firm Check Point spotted the flaw in Facebook-owned WhatsApp and Telegram, though it only affects the web-based versions of those tools, not the mobile apps themselves. It's triggered by sending a malicious file, such as a photo.

Advertisement - Article continues below

"This vulnerability, if exploited, would have allowed attackers to completely take over users' accounts on any browser, and access victims' personal and group conversations, photos, videos and other shared files, contact lists, and more," noted Check Point's researchers in a blog post. "This means that attackers could potentially download your photos and or post them online, send messages on your behalf, demand ransom, and even take over your friends' accounts."

To use the flaw, attackers would send a file to the target that looked innocent but contained malicious code, which opens up access to let the hacker grab data. It takes advantage of WhatsApp's encryption, which protects an image from being viewed without validating it first. That means the malicious file can sneak through.

"Since messages were encrypted without being validated first, WhatsApp and Telegram were blind to the content, thus making them unable to prevent malicious content from being sent," Check Point's researchers noted.

Advertisement
Advertisement - Article continues below
Advertisement - Article continues below

The flaw was reported to WhatsApp and Telegram on 7 March, with a patch already rolled out. Anyone using the web version of either messaging app should make sure they restart the browser to ensure they are using the latest version.

Director of the Kent Cyber Security Centre, Eerke Boiten, agreed, saying it was worth stressing it's not encryption that's at issue, but malicious files.

"That they cannot be spotted is being blamed on the fact that they're encrypted - but spotting malicious files is an inexact science to start with; of course encryption does make it harder," he said. "WhatsApp say they will fix this by screening files for malicious content before they get encrypted and sent across; that seems sensible but imperfect."

Nevertheless, the fact malicious files hidden the way Check Point's researchers slipped them in was indeed a security design error, he said. "File previews could be just that, but it looks like they have used general web browser functionality for those, and thus allow code from inside a malicious file to actually attack the Whatsapp user's account," he added.

Advertisement - Article continues below

Boiten said it was similar to previous coverage of WhatsApp flaws, notably mention of the app in a tranche of CIA files leaked by Wikileaks. "The Wikileaks leak on CIA tools earlier had a completely gratuitous mention of WhatsApp: of course if you can control the device on which the encryption takes place, encryption itself has become pointless as you can grab the data before encryption takes place," he said. "That is not a flaw or even a 'circumvention' of the encrypted communication."

That doesn't mean the messaging service is perfectly secure, he noted. "Despite stories attacking WhatsApp for the wrong reasons, of course some caution regarding WhatsApp remains sensible," he said. "They may be encrypting the contents of communications, but the metadata of who messages whom (and when, and from where) is still visible to them. Such metadata is likely to be more useful than the content anyway, for their owners Facebook and other surveillance outfits."

Advertisement
Advertisement

Recommended

Visit/security/vulnerability/355236/hp-support-assistant-flaws-leave-windows-devices-open-to-attack
vulnerability

HP Support Assistant flaws leave Windows devices open to attack

6 Apr 2020
Visit/security/cyber-security/355234/safari-bug-let-hackers-access-cameras-on-iphones-and-macs
cyber security

Safari bug let hackers access cameras on iPhones and Macs

6 Apr 2020
Visit/software/video-conferencing/355229/zoom-we-moved-too-fast
video conferencing

Zoom CEO admits company "moved too fast" as privacy issues mount

6 Apr 2020
Visit/security/internet-security/355228/mozilla-fixes-two-firefox-zero-days-being-actively-exploited
internet security

Mozilla fixes two Firefox zero-days being actively exploited

6 Apr 2020

Most Popular

Visit/mobile/mobile-phones/355239/microsofts-patent-design-reveals-a-mobile-device-with-a-third-screen
Mobile Phones

Microsoft patents a mobile device with a third screen

6 Apr 2020
Visit/development/application-programming-interface-api/355192/apple-buys-dark-sky-weather-app-and-leaves
application programming interface (API)

Apple buys Dark Sky weather app and leaves Android users in the cold

1 Apr 2020
Visit/software/video-conferencing/355229/zoom-we-moved-too-fast
video conferencing

Zoom CEO admits company "moved too fast" as privacy issues mount

6 Apr 2020