messaging application, patched an incredibly frustrating software
bug that could have allowed a malicious group member to crash the
messaging app for all members of the same group, The Hacker News
learned.
Just by sending a maliciously crafted message to a targeted
group, an attacker can trigger a fully-destructive WhatsApp
crash-loop, forcing all group members to completely uninstall the
app, reinstall it, and remove the group to regain normal
function.
Since the group members can’t selectively delete the malicious
message without opening the group window and re-triggering the
crash-loop, they have to lose the entire group chat history,
indefinitely, to get rid of it.
Discovered by researchers at Israeli cybersecurity firm Check
Point[1], the latest bug resided
in the WhatsApp’s implementation of XMPP communication protocol
that crashes the app when a member with invalid phone number drops
a message in the group.
“When we attempt to send a message where the parameter
‘participant’ receives a value of ‘null,’ a ‘Null Pointer
Exception’ is thrown,” the researchers explain in a report shared
with The Hacker News prior to its release.
“The parser for the participant’s phone number mishandles the input
when an illegal phone number is received. When it receives a phone
number with a length, not in the ranger 5-20 or a non-digit
character, it would read it as a ‘null’ string.”
parameters associated with messages in a conversation that is
otherwise protected using end-to-end encryption. In order to carry
out this attack, an attacker can leverage WhatsApp Web and a web
browser debugging tool in combination with an open source WhatsApp
manipulation tool that Check Point released last year.
The WhatsApp
manipulation tool[2]
is an extension for Burp Suite penetration testing software that
allows users to intercept, decrypt, and re-encrypt their WhatsApp
communication using their own encryption keys.
As shown in the video demonstration, the researchers used this
setup to trigger the crash bug against all members of a group by
simply replacing the participant’s parameter from the sender’s
phone number to ‘a@s.whatsapp.net,’ an invalid non-digit phone
number.
“The bug will crash the app, and it will continue to crash even
after we reopen WhatsApp, resulting in a crash loop,” the
researchers say.
“Moreover, the user will not be able to return to the group and all
the data that was written and shared in the group is now gone for
good. The group cannot be restored after the crash has happened and
will have to be deleted in order to stop the crash.”
since the malicious message was injected in transit after it left
the sender’s device.
security team back in late August this year, and the company
patched the issue with the release of WhatsApp version 2.19.58 in
mid-September.
The WhatsApp developers also “added new controls to prevent
people from being added to unwanted groups to avoid communication
with untrusted parties altogether.”
“Because WhatsApp is one of the world’s leading communication
channels for consumers, businesses and government agencies, the
ability to stop people using WhatsApp and delete valuable
information from group chats is a powerful weapon for bad actors,”
Oded Vanunu, Check Point’s Head of Product Vulnerability Research
said.
up-to-date in order to protect themselves against known
attacks.
References
- ^
Check Point
(research.checkpoint.com) - ^
WhatsApp manipulation tool
(github.com)
Read more http://feedproxy.google.com/~r/TheHackersNews/~3/7GbV3JlKhRE/whatsapp-group-crash.html