An annual Black Hat security conference was held on 7th August in Las Vegas. At conference Israeli Security Company, Check Point disclosed the WhatsApp's vulnerability that let hackers change the message and also modify the sender’s identity.
The vulnerabilities were brought to WhatsApp’s notice in 2018, but till now these remain unresolved.
Roman Zaikin and his team at Check Point gave a presentation, “Reverse Engineering WhatsApp” in which they talked about the process of how they discovered flaws and informed WhatsApp about it.
In 2018, Zaakin, Vannu along with other researchers researcher WhatsApp web source code and succeeded in decrypting the WhatsApp traffic. They were creating an extension to a web application testing tool, Burp Suite, when they discovered the vulnerabilities.
The Check Point team managed to identify three attack modes through exploiting social engineering tricks. This could let hackers manipulate and intercept messages on WhatsApp.
These three attack modes were:
1. Private message sent to another individual of the group could be visible to other group members as well.
2. The sender’s identity could be changed by using the ‘quote’ function, to a person who may not be the part of the group chat.
3. Attackers could put words in other’s mouth by altering their replies in text form.
By the end of 2018, the company was informed about the vulnerabilities stating that these require instant attention. So far, WhatsApp managed to fix only one threat of making private messages more secure.
Head of products vulnerabilities at Check Point, Oded Vanunu, and his team explained the reason why they are presenting about vulnerabilities at the Black hat. According to them, instant messaging technology, like WhatsApp, has become an integral part of lives, both at a professional and personal level.
Though upon informing, WhatsApp responded on time, but according to Check Point, not enough actions were taken. Thus, the purpose of their presentation was to create awareness a Black Hat USA 19.
WhatsApp responded to the issue, saying that these issues were reviewed by them a year ago. However, they did not find any vulnerability in the security that Facebook provides to its users. WhatsApp’s spokesperson said that if these issues were addressed, it could make WhatsApp less private like it might require to store other information like location.
A cybersecurity expert at ZeroDayLab, Stuart Peck said that it is essential for users to know that the messages they are receiving re from trusted source. He was surprised at the Facebook stayed ignorant of the issues despite being part of several controversies of trust issues.
Peck suggested that Facebook must look into the matter seriously where users might receive manipulated age without any notification the fraudulent.
There are chances that users could be attacked more, and if the company does not pay much attention to this, users should consider moving to another encrypted messaging service, Said Peck.
Read next: WhatsApp will soon be introducing a boomerang-like feature
Featured photo: Omar Marques/SOPA Images/LightRocket/Getty Images
The vulnerabilities were brought to WhatsApp’s notice in 2018, but till now these remain unresolved.
Roman Zaikin and his team at Check Point gave a presentation, “Reverse Engineering WhatsApp” in which they talked about the process of how they discovered flaws and informed WhatsApp about it.
In 2018, Zaakin, Vannu along with other researchers researcher WhatsApp web source code and succeeded in decrypting the WhatsApp traffic. They were creating an extension to a web application testing tool, Burp Suite, when they discovered the vulnerabilities.
The Check Point team managed to identify three attack modes through exploiting social engineering tricks. This could let hackers manipulate and intercept messages on WhatsApp.
These three attack modes were:
1. Private message sent to another individual of the group could be visible to other group members as well.
2. The sender’s identity could be changed by using the ‘quote’ function, to a person who may not be the part of the group chat.
3. Attackers could put words in other’s mouth by altering their replies in text form.
By the end of 2018, the company was informed about the vulnerabilities stating that these require instant attention. So far, WhatsApp managed to fix only one threat of making private messages more secure.
Head of products vulnerabilities at Check Point, Oded Vanunu, and his team explained the reason why they are presenting about vulnerabilities at the Black hat. According to them, instant messaging technology, like WhatsApp, has become an integral part of lives, both at a professional and personal level.
Though upon informing, WhatsApp responded on time, but according to Check Point, not enough actions were taken. Thus, the purpose of their presentation was to create awareness a Black Hat USA 19.
WhatsApp responded to the issue, saying that these issues were reviewed by them a year ago. However, they did not find any vulnerability in the security that Facebook provides to its users. WhatsApp’s spokesperson said that if these issues were addressed, it could make WhatsApp less private like it might require to store other information like location.
A cybersecurity expert at ZeroDayLab, Stuart Peck said that it is essential for users to know that the messages they are receiving re from trusted source. He was surprised at the Facebook stayed ignorant of the issues despite being part of several controversies of trust issues.
Peck suggested that Facebook must look into the matter seriously where users might receive manipulated age without any notification the fraudulent.
There are chances that users could be attacked more, and if the company does not pay much attention to this, users should consider moving to another encrypted messaging service, Said Peck.
Read next: WhatsApp will soon be introducing a boomerang-like feature
Featured photo: Omar Marques/SOPA Images/LightRocket/Getty Images
