TechTarget.com/searchsecurity

https://www.techtarget.com/searchsecurity/news/252446722/WhatsApp-vulnerabilities-let-hackers-alter-messages

WhatsApp vulnerabilities let hackers alter messages

By Madelyn Bacon

Attackers are able to intercept and manipulate messages in the encrypted messaging app WhatsApp.

According to new research from Check Point, there are WhatsApp vulnerabilities that enable attackers to manipulate and modify messages in both public and private conversations. This type of manipulation could make it easy to continue the spread of misinformation.

WhatsApp, which is owned by Facebook, has over 1.5 billion users who send approximately 65 billion messages daily. The Check Point researchers warned of online scams, rumors and the spread of fake news with a user base that large, and WhatsApp has already been used for a number of these types of scams.

The new WhatsApp vulnerabilities that Check Point outlined in its blog post involve social engineering techniques that can be used to deceive users in three ways: by changing the identity of the sender of a message in a group, changing the text of someone else's reply message, and by sending a private message to a group member to which replies are made public.

"We believe these vulnerabilities to be of the utmost importance and require attention," the researchers wrote.

The WhatsApp vulnerabilities have to do with the communications between the mobile version of the application and the desktop version. Check Point was able to discover them by decrypting the communications between the mobile and desktop version.

"By decrypting the WhatsApp communication, we were able to see all the parameters that are actually sent between the mobile version of WhatsApp and the Web version. This allowed us to then be able to manipulate them and start looking for security issues," the researchers wrote in their blog post detailing the WhatsApp vulnerabilities.

In the first attack outlined by Check Point's Dikla Barda, Roman Zaikin and Oded Vanunu, hackers can change the identity of a sender in a group message, even if they are not part of the group. The researchers were also able to change the text of the message to something completely different.

In the second attack, a hacker can change someone's reply to a message. In doing this, "it would be possible to incriminate a person, or close a fraudulent deal," the Check Point team explained.

In the final attack disclosed, "it is possible to send a message in a group chat that only a specific person will see, though if he replies to this message, the entire group will see his reply." This means that the person who responds could reveal information to the group that he did not intend to.

Check Point said it disclosed these vulnerabilities to WhatsApp before making them public.

In other news

• Computers at the office of PGA America have reportedly been infected with ransomware. According to a report from Golfweek, employees of the golf organization noticed the infection earlier this week when a ransom note appeared on their screens when they tried to access the affected files. "Your network has been penetrated. All files on each host in the network have been encrypted with a strong algorythm (sic)," the note said, according to Golfweek. The files contained information for the PGA Championship at Bellerive and the Ryder Cup in France, including "extensive" promotional materials. According to the Golfweek report, no specific ransom amount was demanded, though the hacker included a bitcoin wallet number.
• Microsoft may be adding a new security feature to Windows 10 called "InPrivate Desktop." According to a report from Bleeping Computer, the feature acts like a "throwaway sandbox for secure, one-time execution of untrusted software" and will only be available on Windows 10 Enterprise. Bleeping Computer became aware of this previously undisclosed feature through a Windows 10 Insider Feedback Hub quest and said that it will enable "administrators to run untrusted executables in a secure sandbox without fear that it can make any changes to the operating system or system's files." The Feedback Hub said it is an "in-box, speedy VM that is recycled when you close" the application, according to the report. There are no details yet about when this feature may be rolled out.
• Comcast Xfinity reportedly exposed personal data of over 26.5 million of its customers. Security researcher Ryan Stevenson discovered two previously unreported vulnerabilities in Comcast Xfinity's customer portals and through those vulnerabilities, partial home addresses and Social Security numbers of Comcast customers were exposed. The first vulnerability could be exploited by refreshing an in-home authentication page that lets users pay their bills without signing into their accounts. Through this, hackers could have figured out the customer's IP address and partial home address. The second vulnerability was on a sign-up page for Comcast's Authorized Dealer and revealed the last four digits of a customer's SSN. There is no evidence yet that the information was actually stolen, and Comcast patched the vulnerabilities after Stevenson reported them.