Friday, November 15, 2019
ADVT 
International

Warning: Malicious Flaw Affects 1 Billion WhatsApp Users

Darpan News Desk IANS, 04 Oct, 2019
  • Warning: Malicious Flaw Affects 1 Billion WhatsApp Users

WhatsApp is by far one of the most secure messaging platforms in the world; however, like every technology out there, it does come with its own set of unique flaws.


This year itself, various reports have disclosed certain vulnerabilities that have plagued WhatsApp which can be exploited by attacks or which have the potential to leave users open to harmful consequences. The flaws range from sophisticated nation-state attacks to misleading functionality as well as targeted hacking.


Recently, a new bug has come to light that allows an attacker to use a malicious GIF image file to open a vulnerability in WhatsApp and potentially access user content. As per a report by Forbes, this bug was identified and shared by “technologist and information security enthusiast” Awakened on Github. Also, there is a detailed explanation of how this bug works.


It’s a bit complex but basically, the bug depends on an attacker pushing the malicious GIF file to the victim’s device through any channel. This could include WhatsApp, email or any messaging platform.


With this GIF on the device, when a victim opens the gallery within WhatsApp to send any image (not necessarily a malicious image), the hack gets activated and the device and its contents become potentially vulnerable.


WhatsApp needs to step up its game in five areas.


Wakened has warned, “WhatsApp users please do update to latest WhatsApp version (2.19.244 or above) to stay safe from this bug.”


The report states, “From a technical perspective, the attack relies on a so-called double-free bug, where the same memory address on the device is called twice, pushing memory allocation into an unexpected spin, which either crashes the app or opens the vulnerability.


Replicating an attack using the bug does not seem to be entirely reliable, and affects different versions of the operating system software in different ways, but a bug is a bug and once identified can be developed and expanded upon.”


Speaking to TNW regarding this bug, WhatsApp states there have been no reports of any attacks on users exploiting this vulnerability. What’s more “this issue affects the user on the sender side, meaning the issue could, in theory, occur when the user takes action to send a GIF. The issue would impact their own device.”


To this Awakened says, “I would say that the above claim is not correct. The spokesperson must have misunderstood the issue.”


What Awakened is trying to say is that although there is some trigger that’s required from the victim’s side, opening the gallery within WhatsApp is a regular task and nothing that would raise suspicion. So, as long as the attacker has planted the image on the device, the vulnerability can be exploited.


WhatsApp states that the bug “was reported and quickly addressed last month. We have no reason to believe this affected any users though of course, we are always working to provide the latest security features to our users.”


The report by Forbes goes on to state, “The bug has been identified and patched—the specifics of how it’s exploited matter less now than ensuring that users update to the latest version of the app.


And while this only seems to impact Android devices, that advice to update is universal. Once a vulnerability reaches the public domain, there is always a risk of it being used—would-be attackers are well aware of the inertia that sees many users update apps much more sporadically than is healthy for their data security.”

MORE International ARTICLES

Greta Thunberg Changes Her Twitter Bio To Mock Putin After He Criticised Her Speech

Greta Thunberg Changes Her Twitter Bio To Mock Putin After He Criticised Her Speech

At the summit, Greta accused world leaders and politicians of being apathetic towards climate change and also destroying her childhood with their empty words and promises.

Greta Thunberg Changes Her Twitter Bio To Mock Putin After He Criticised Her Speech

Ex-Pak Ruler Pervez Musharraf Plans Return To Politics On October 6

Ex-Pak Ruler Pervez Musharraf Plans Return To Politics On October 6

Pervez Musharraf, 76, who has been living in Dubai since March 2016, is facing a treason case for suspending the Constitution in 2007, a punishable offence for which he was indicted in 2014. A conviction for high treason carries the death penalty or life imprisonment.

 

Ex-Pak Ruler Pervez Musharraf Plans Return To Politics On October 6

Facebook Encryption Threatens Public Safety, UK Home Secretary Priti Patel Tells CEO Mark Zuckerberg

Facebook Encryption Threatens Public Safety, UK Home Secretary Priti Patel Tells CEO Mark Zuckerberg

Priti Patel, the senior-most minister in the UK Cabinet stressed that while strong encryption was important for privacy, there was a need to balance data security with law enforcement requirements.

 

Facebook Encryption Threatens Public Safety, UK Home Secretary Priti Patel Tells CEO Mark Zuckerberg

Australian PM Scott Morrison's India Visit In January To Focus On Indo-Pacific Strategy

Australian PM Scott Morrison's India Visit In January To Focus On Indo-Pacific Strategy

Australian Prime Minister Scott Morrison said his government was keen to work with the Quad countries, the United States, Australia, India and Japan.

 

Australian PM Scott Morrison's India Visit In January To Focus On Indo-Pacific Strategy

UK Soaks In Durga Puja Fervour, Pandal Set Up in Berkshire County

UK Soaks In Durga Puja Fervour, Pandal Set Up in Berkshire County

The pandal at the cricket ground in Slough is quite unprecedented in the UK as the pujas in the country usually take place in community halls and not in an open ground.

 

UK Soaks In Durga Puja Fervour, Pandal Set Up in Berkshire County

Hyderabad Nizam's Money To Be Divided Among 120 Descendants: Grandson

Hyderabad Nizam's Money To Be Divided Among 120 Descendants: Grandson

The UK High Court had on Wednesday ruled in favour of India and dismissed Pakistan's claim over the money belonging to Nizam Mir Osman Ali Khan.

 

Hyderabad Nizam's Money To Be Divided Among 120 Descendants: Grandson

PrevNext