New Vulnerability found in WhatsApp, read private chats

<div dir="ltr" style="text-align: left;" trbidi="on"> <div class="separator" style="clear: both; text-align: center;"> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjMV7ZNbCJBEVMViXjnvDdTZLvS_yxGYsRM-ueqmB8PvuVWfgEtxy0IKs39CXiTkStUIoRE8sn6PWwb1VcWL7k19RwSkZkIkIkiPEJm3jDSHkCgpUjAWVheakIS437iPbWkYbBnlsmTMFba/s1600/new-vulnerability+in+whatsapp.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="New Vulnerability found in WhatsApp" border="0" height="167" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjMV7ZNbCJBEVMViXjnvDdTZLvS_yxGYsRM-ueqmB8PvuVWfgEtxy0IKs39CXiTkStUIoRE8sn6PWwb1VcWL7k19RwSkZkIkIkiPEJm3jDSHkCgpUjAWVheakIS437iPbWkYbBnlsmTMFba/s1600/new-vulnerability+in+whatsapp.jpg" title="New Vulnerability found in WhatsApp" width="320" /></a></div> <br /> A security consultant has uncovered a <a href="http://www.hackerschronicle.com/search/label/Vulnerability" target="_blank">security hole</a> in <a href="http://www.hackerschronicle.com/search/label/WhatsApp" target="_blank">WhatsApp</a>, the instant messaging platform recently acquired by <a href="http://www.hackerschronicle.com/search/label/Facebook" target="_blank">Facebook</a>. The flaw can be leveraged to gain access to the private chats of Android device owners.<br /> Many people are concerned with the <a href="http://www.hackerschronicle.com/search/label/Privacy" target="_blank">privacy</a> implications that come with Facebook’s acquisition of WhatsApp. However, as Bas Bosschert, the man who identified the vulnerability, highlights, Facebook didn’t need to buy the company if all it wanted to do was read users’ chats.<br /> The expert has found that any Android app that’s allowed access to the SD card installed on the device can easily access private conversations. <br /> All chats are saved in a database file (msgstore.db) that’s stored on the SD card. Bosschert has developed a <a href="http://bas.bosschert.nl/steal-whatsapp-database/#more-1" target="_blank">proof-of-concept</a> which demonstrates that any app that’s granted permission to access the card can easily retrieve the database and upload it to a remote server.<br /> According to Bosschert, in newer versions of <a href="http://www.whatsapp.com/%E2%80%8E" target="_blank">WhatsApp</a>, the database file is encrypted. However, this doesn’t mean that users’ private chats are secure. It simply means that an attacker would have to decrypt the database file to gain access to its contents.<br /> The decryption key can be found in WhatsApp Xtract, an app that allows users to create backups of WhatsApp conversations.<br /> The POC developed by the expert is designed so that when the database is retrieved, the victim only sees a simple loading screen. Cybercriminals could combine the data-stealing code with a popular application to harvest a large number of databases. <br /> In February, security researchers from Praetorian revealed finding a number of SSL-related vulnerabilities in WhatsApp. Most of them were fixed almost immediately by the company. <br /> Source: <a href="http://www.softpedia.com/" rel="nofollow" target="_blank">Softpedia</a></div>

Mobile Vulnerability WhatsApp New Vulnerability found in WhatsApp, read private chats

A security consultant has uncovered a security hole in WhatsApp , the instant messaging platform recently acquired by Facebook . The fl...

Read more »