Hackers Can Manipulate Media Files You Receive Via WhatsApp and Telegram

Security researchers at Symantec yesterday demonstrated multiple
interesting attack scenarios against WhatsApp and Telegram Android
apps, which could allow malicious actors to spread fake news or
scam users into sending payments to wrong accounts.

Dubbed “Media File Jacking,” the attack leverages an
already known fact that any app installed on a device can access
and rewrite files saved in the external storage, including files
saved by other apps installed on the same device.

WhatsApp and Telegram allow users to choose if they want to save
all incoming multimedia files on internal or external storage of
their device.

However, WhatsApp for Android by default automatically stores media
files in the external storage, while Telegram for Android uses
internal storage to store users files that are not accessible to
any other app.

But, many Telegram users manually change this setting to
external storage, using “Save to Gallery” option in the settings,
when they want to re-share received media files with their friends
using other communication apps like Gmail, Facebook Messenger or
WhatsApp.

It should be noted that the attack is not just limited to
WhatsApp and Telegram, and affects the functionality and privacy of
many other Android apps as well.

How Does “Media File Jacking” Attack Work?

1.) Image manipulation

In this attack scenario, a seemingly innocent-looking, but actually
malicious, app downloaded by a user can run in the background to
perform a Media File Jacking attack while the victim uses WhatsApp
and “manipulate personal photos in near-real-time and without the
victim knowing.”

2.) Payment manipulation

In this scenario, which researchers call “one of the most damaging
Media File Jacking attacks,” a malicious actor can manipulate an
invoice sent by a vendor to customers to trick them into making a
payment to an account controlled by the attacker.

3.) Audio message spoofing

In this attack scenario, attackers can exploit the relations of
trust between employees in an organization. They can use voice
reconstruction via deep learning technology to alter an original
audio message for their personal gain or to wreak havoc.

4.) Spread fake news

In Telegram, admins use the concept of “channels” in order to
broadcast messages to an unlimited number of subscribers who
consume the published content. Using Media File Jacking attacks, an
attacker can change the media files that appear in a trusted
channel feed in real-time to spread fake news.

How to Prevent Hackers from Hijacking Your Android Files

Symantec already notified Telegram and Facebook/WhatsApp about the
Media File Jacking attacks, but it believes the issue will be
addressed by Google with its upcoming Android Q
update.
Android Q includes a new privacy feature called Scoped
Storage that changes the way apps access files on a device’s
external storage.

Scoped
Storage^[4] gives each app an
isolated storage sandbox into the device external storage where no
other app can directly access data saved by other apps on your
device.

Until then, users can mitigate the risk of such attacks by
disabling the feature responsible for saving media files to the
device’s external storage. To do so, Android users can head on
to:

• WhatsApp: Settings → Chats → Turn the toggle off for ‘Media
  Visibility’
• Telegram: Settings → Chat Settings → Disable the toggle for
  ‘Save to Gallery’

^[1][3]