GO SMS Pro, a popular messaging app for Android with over 100
million installs, has been found to have an unpatched security flaw
that publicly exposes media transferred between users, including
private voice messages, photos, and videos.
“This means any sensitive media shared between users of this
messenger app is at risk of being compromised by an unauthenticated
attacker or curious user,” Trustwave Senior Security Consultant
Richard Tan said in a report[1]
shared with The Hacker News.
According to Trustwave SpiderLabs, the shortcoming was spotted
in version 7.91 of the app, which was released on the Google Play
Store on February 18, 2020.
The cybersecurity firm said it attempted to contact the app
makers multiple times since August 18, 2020, without receiving a
response.
But checking the app’s changelog, GO SMS Pro received an update
(v7.92) on September 29, followed by another subsequent update,
which was published yesterday. The latest updates to the app,
however, still doesn’t address the weakness mentioned above.
The vulnerability stems from the manner media content is
displayed when recipients don’t have the GO SMS Pro app installed
on their devices, leading to potential exposure.
“If the recipient has the GO SMS Pro app on their device, the
media would be displayed automatically within the app,” Tan said.
“However, if the recipient does not have the GO SMS Pro app
installed, the media file is sent to the recipient as a URL via
SMS. The user could then click on the link and view the media file
via a browser.”
Not only is this link (e.g. “https://gs.3g.cn/D/dd1efd/w”)
accessible to anyone without prior authentication, the URL is
generated irrespective of whether the recipient has the app
installed, thereby allowing a malicious actor to access any media
files sent via the app.
Specifically, by incrementing the sequential hexadecimal values
in the URL (e.g., “https://gs.3g.cn/D/e3a6b4/w”), the flaw makes it
possible to view or listen to other media messages shared between
other users. An attacker can leverage this technique to generate a
list of URLs and steal user data without their knowledge.
It’s likely that the flaw impacts the iOS version of GO SMS Pro
as well, but until there’s a fix in place, it is highly recommended
to avoid sending media files using the affected messenger app.
We have reached out to the developers of GO SMS Pro, and we will
update the story if we hear back.