A Vulnerability has been discovered in the
wildly popular messaging app WhatsApp,
which allows anyone to remotely crash
WhatsApp just by sending a specially
crafted message, two security researchers
reported ‘ The Hacker News’.
Two India based independent security
researchers, Indrajeet Bhuyan and Saurav
Kar, both 17-year old teenagers
demonstrated the WhatsApp Message
Handler vulnerability to one of our security
analyst.
In a video demonstration, they showed that
how a 2000 words (2kb in size) message in
special character set can crash Whatsapp
messenger app. Previous it was discovered
that sending a huge message ( greater than
7mb in size) on Whatsapp could crash victim
device and app immediately, but using this
new exploit attacker only need to send a very
small size (approx 2kb) message to the
victim.
The worried impact of the vulnerability is
that the user who received the specially
crafted message will have to delete his/her
whole conversation and start a fresh chat,
because opening the message keeps on
crashing WhatsApp unless the chat is
deleted completely.
"What makes it more serious is that
one needs to delete entire chat with
the person they are chatting to in
order to get back whatsapp work in
normal ," Bhuyan told THN in an e-
mail.
According to the duo, the reported
vulnerability has been tested and
successfully works on most of the versions
of Android Operating system including
Jellybean, Kitkat, and all the below android
versions.
Similarly, Any member of your WhatsApp
group could intentionally send a specially
crafted message to exit people from the
group and delete the group. Also, for
example, if I don’t want someone to keep
records of my chat with them, then I can also
send the same message exploit to the
person.
The vulnerability has not been tested on iOS,
but it is sure that all versions of WhatsApp
including 2.11.431 and 2.11.432 are
affected with this bug. Also the attack does
not work on Windows 8.1.
They have also provided the Proof-of-
Concept (PoC) video for the attack, users
can watch above.
WhatsApp, bought by Facebook for $19 billion
in February this year, has 600 Million users
as of October 2014, and according to the
researchers, an estimated number of users
affected by the vulnerability could be 500
Million.
WhatsApp was in news recently for making
end-to-end encryption on all text messages
as a default feature in an effort to boost
the online privacy and security of its users
around the world. The app maker describe
this move as the "largest deployment of
end-to-end encryption ever.
0 comments:
Post a Comment