Threat intelligence researchers at the Israeli cybersecurity firm Check Point Software Technologies Ltd. said they helped identify and fix a new vulnerability in the popular messaging app WhatsApp that could have allowed a bad actor to deliver a malicious group chat message that would crash the app for all members of the group. To regain use of WhatsApp, users would need to uninstall and reinstall it, then delete the group that contained the message.
WhatsApp has 1.5 billion users and more than a billion groups, making it the most popular instant messaging app worldwide. Over 65 billion messages are sent via WhatsApp per day.
To create a malicious message that would impact a WhatsApp group in this way, the bad actor would need to be a member of the group (WhatsApp allows up to 256 users per group), Check Point, a provider of cybersecurity software, said in a statement on Tuesday.
From there, the bad actor would need to use WhatsApp Web and their web browser’s debugging tool to edit specific message parameters and send the edited text to the group. This edited message would cause a crash loop for group members, denying users access to all WhatsApp functions until they reinstall WhatsApp and delete the group with the malicious message.
“Because WhatsApp is one of the world’s leading communication channels for consumers, businesses and government agencies, the ability to stop people using WhatsApp and delete valuable information from group chats is a powerful weapon for bad actors,” said Oded Vanunu, head of Product Vulnerability Research at Check Point Research, the research arm of the firm, said in the statement. “All WhatsApp users should update to the latest version of the app to protect themselves against this possible attack.”
The researchers alerted WhatApp’s bug program about the flaw in August. WhatsApp acknowledged the findings and developed a fix to resolve the issue. This fix is available in WhatsApp version number 2.19.58, which users should manually apply on their devices, the statement said.
“We quickly resolved this issue for all WhatsApp apps in mid-September,” said WhatsApp Software Engineer Ehren Kret in the statement. “We have also recently added new controls to prevent people from being added to unwanted groups to avoid communication with untrusted parties all together.”
The Check Point Research team found the vulnerability by inspecting the communications between WhatsApp and WhatsApp Web, the web version of the app which mirrors all messages sent and received from the user’s phone. This enabled researchers to see the parameters used for WhatsApp communications and manipulate them.