A computer security firm on Wednesday reveals a flaw that could let hackers break into WhatsApp or Telegram messaging accounts using the very encryption intended to protect messages.
Check Point Software Technologies says that it alerted Telegram and Facebook-owned WhatsApp last week, waiting until the vulnerability was patched before making it public.
Check Point did not specify how many messaging accounts were at risk, but did say the flaw posed a danger to “hundreds of millions” of users accessing the messaging platform from web browsers in computers, as opposed to mobile applications.
“This new vulnerability put hundreds of millions of WhatsApp Web and Telegram Web users at risk of complete account takeover,” Check Point head of product vulnerability Oded Vanunu says in a release.
“By simply sending an innocent-looking photo, an attacker could gain control over the account, access message history, all photos that were ever shared, and send messages on behalf of the user.”
On a chat on the WhatsApp app, an Islamic State group militant offers a woman and her children for sale, in this May 22, 2016, photo taken in northern Iraq. ‘If you know one of the brothers who has a slave for sale, please let me know,’ it reads in Arabic. ‘She wants her owner to sell her. He wants a price of $3,700 for her. She has two daughters, one 3 years old, the other 7 months.’ IS is believed to be holding some 3,000 Yazidi women and girls as sex slaves, and as it loses territory, it has tightened its grip on them to prevent their escape. (AP/Maya Alleruzzo)
The vulnerability made it possible for an attacker to booby-trap a digital image with malicious code that could spring into action after the picture is clicked on for viewing, according to Check Point.
The malicious code could then hijack an account, and even spread itself like a virus by sending infected messages to those listed as contacts.
WhatsApp and Telegram use end-to-end encryption designed to make certain only senders and recipients can see what is in messages.
The privacy protection had the side effect of preventing the services from being able to discern whether message contents included malicious code, according to Check Point.
To remedy the situation, both services shifted to finding and blocking viruses before messages are encrypted, the security researchers say.
— AFP
Help us report truthfully on social media
As a multimedia journalist, my job is to take the quality, fact-based journalism produced by The Times of Israel newsroom and make it accessible across every platform — from Instagram posts to podcasts to short-form videos.
This is how many, especially young people, consume news these days. But misinformation is rampant on social media. Our team at ToI produces accurate, responsible short-form reporting on Israel and the Jewish world.
If you believe in the importance of factual social media journalism, please consider joining our reader support group, The Times of Israel Community. Your financial support is essential to sustain responsible multimedia reporting.
We’re really pleased that you’ve read X Times of Israel articles in the past month.
That’s why we started the Times of Israel - to provide discerning readers like you with must-read coverage of Israel and the Jewish world.
So now we have a request. Unlike other news outlets, we haven’t put up a paywall. But as the journalism we do is costly, we invite readers for whom The Times of Israel has become important to help support our work by joining The Times of Israel Community.
For as little as $6 a month you can help support our quality journalism while enjoying The Times of Israel AD-FREE, as well as accessing exclusive content available only to Times of Israel Community members.
Thank you, David Horovitz, Founding Editor of The Times of Israel
From the Liveblog of
Wednesday, March 15, 2017
Add ToI as a Preferred Source on Google
