WhatsApp group chats can easily be infiltrated, find researchers

14 January, 2018, 00:12 | Author: Jeannette Greene
  • WhatsApp Group Chat Bug

The innovative November update allowed users to delete messages within seven minutes of sending them. So theoretically, intercepting and reading a message would not be possible by a third party.

That seems to be enough for them at the moment, especially because a fix for the flaw could end up breaking the convenient "group invite link" feature.

Computer researchers have discovered a set of flaws in WhatsApp that could allow uninvited individulals into private group chats.

How does the exploit work?

"The described weaknesses enable attacker A, who controls the WhatsApp server or can break the transport layer security, to take full control over a group", the paper states.

"Anyone who controls the app's servers could insert new people into private group chats without needing admin permission", the report said, citing cryptographers.

But this new flaw means it would now technically be possible to infiltrate group messages, bypassing encryption. But that possibility of detection isn't an adequate solution to WhatsApp's underlying problem, argues John Hopkins' Green. They also point out that the lack of any authentication mechanism to deal with the invitation for new members also worsens the security.


It is not the first serious vulnerability that researchers have discovered on WhatsApp's messaging platform, with security firm Checkpoint uncovering a loophole previous year that allowed hackers to completely take over users' accounts and access conversations, contact lists, photos, videos and other shared media. It would appear as if the new member had the permission of the admin to join.

Once the eavesdropper is in the group, he/she would have access to all future messages sent on the group as WhatsApp would generate secret keys for each member in the group and share it with the newcomer. Clients of a group retrieve membership from the server, and clients encrypt all messages they send e2e to all group members. This would include messages asking about the new member and even those that say to be wary of the newcomer. But how simple can it be to get access to the WhatsApp servers?

According to the researchers, once an attacker with control of the WhatsApp server had access to the conversation, he or she could also use the server to selectively block any messages in the group.

There's no doubt that encryption is a critical tool for protecting our data.

The researchers advised in their paper that sums up their findings, that users who rely on complete privacy should stick to Signal (an encrypted communications app) or private messaging. In reality, an attack of this nature is bound to be uncovered sooner or later. However, in case he does not notice, the group is compromised. This is claimed to indicate that your name has been mentioned four times in that specific WhatsApp group. This is where researchers are paid to report hack able flaws in the company's software. This feature is now under testing and there is no word regarding when it will be rolled out to the public as a part of the stable version of WhatsApp. If you notice anyone who should not be there, immediately notify the group admin.

As per a WABetaInfo report, the new option will be available in the Group Info section as "Dismiss as admin" and will allow the admin to demote his fellow without removing him from the group.

Recommended:

  • Doug Jones cosponsors bill to renew CHIP funding

    Doug Jones cosponsors bill to renew CHIP funding

    Since 1997, CHIP has provided healthcare to millions of Americans and helped to drastically reduce the uninsured rate of children. A second analysis, released publicly on Thursday, projects $6 billion in savings if Congress funds the program for 10 years.
    Days after cancelling missile deal with Israel, Govt mulls to revive pact

    Days after cancelling missile deal with Israel, Govt mulls to revive pact

    At present, Israel is a major defence supplier to India exporting an average of $1 billion of military equipment each year. Netanyahu told the journalists that Israel has been deepening ties with countries in Asia, Latin America and Africa.
    Manchester United to subsidise €100 tickets for Sevilla clash

    Manchester United to subsidise €100 tickets for Sevilla clash

    Manchester United brass have responded by subsidising the £35 difference for every fan who has bought a ticket. United said they had felt it was only fair to charge their opponents fans a similar amount.
  • Israel detained 3617 Palestinians in 2017

    Israel detained 3617 Palestinians in 2017

    But both groups have failed to finalise details of the deal, which had been due to be completed on 1 December 2017. The Gaza Strip relies on three sources of energy that are not enough to meet its needs.
    Kyrgios on the cusp of Brisbane title

    Kyrgios on the cusp of Brisbane title

    I'm never going to play 25 tournament-plus (in a year) - it's about picking the right tournaments and be invested in the ones I pick.
    National Football League  releases schedule for 2018 games in London

    National Football League releases schedule for 2018 games in London

    To register for NFL London 2018 tickets all you need is your basic details and to state which game you're interested in attending. The Seahawks , Philadelphia Eagles and Tennessee Titans will be playing their first regular-season games in England.
  • Capitol Chat: Gov. Brown's Final Budget

    Capitol Chat: Gov. Brown's Final Budget

    Brown must sign a budget by June 30, giving him and lawmakers about five months to negotiate on spending priorities. State officials and economists said planning for the 2018-2019 budget cycle had been particularly hard this year.
    Meghan's sister accuses her of not helping their father financially

    Meghan's sister accuses her of not helping their father financially

    The look came to an approximate total of £1,160 and it's safe to say, Markle has the whole royal look down to a T. Where Will Prince Harry And Meghan Markle Honeymoon? Seems like a no-brainer to us.
    Home and Away actress Jessica Falkholt 'has life support turned off'

    Home and Away actress Jessica Falkholt 'has life support turned off'

    We'd always have a laugh. "They are together and always will be", he said. "Rest in Peace Jess, you will be missed so very much". The devastating crash killed her sister Annabelle, 21, and parents Lars, 69, and Vivian, 60, along with Whitall.
  • Test fire of SpaceX Falcon Heavy rocket moves to Saturday

    Test fire of SpaceX Falcon Heavy rocket moves to Saturday

    Cheers erupted at SpaceX headquarters in Hawthorne, California as the rocket glided seamlessly down to ground. However, these censored bits are par for the course when it comes to SpaceX's missions for the government.
    Funke Akindele To Star In Hollywood Movie, Avengers

    Funke Akindele To Star In Hollywood Movie, Avengers

    Avengers: Infinity War is still months away, and we are already looking for clues as to what could happen in Avengers 4 . It's been speculated that these could be devices to help keep them connected to the present as they travel through time.
    'Camila' review: Camila Cabello's powerful solo debut

    'Camila' review: Camila Cabello's powerful solo debut

    Sadly, Cabello said she would have like to stay with the band but it became impossible because she chose to follow her passion. The Loving, but the Times story confirms it was changed so that Cabello could officially wash her hands of 5H drama.


Popular

Intel Says Meltdown, Spectre Patches Can Cause Reboot Problems in Old Chips
With regards to Variant 1 ( Spectre , Bounds Check Bypass), Papermaster says that AMD processors are in fact vulnerable. The company advised end-users to continue to apply updates recommended by their system and operating system providers.

Georgia's Jacob Eason to transfer to Washington
After just a couple snaps in 2017, Georgia fans never got to know what Eason had became after beating out Fromm in the offseason. In 14 games at UGA, Eason completed 208 of 377 passes for 2,458 yards, 16 touchdowns, and eight interceptions.

Officials See Trump Tax Paycheck Windfall but Urge Accuracy Check
The GAO has said Wyden's request must go through its usual review process before a decision to proceed is made. Two Democratic lawyers asked the watchdog Government Accountability Office to review the guidelines.

Mets agree to $39M, three-year deal with free agent Jay Bruce
Martinez still out there seemingly holding up other players, however, seems to have created a buyers market in January. The lack of movement on the free agent market this winter and particularly with top slugging outfielder J.D.

Now is the time to test your home for radon gas
Radon test kits are available at Cooperative Extension offices and partnering locations, as well as at presentations statewide. A simple three-day test can determine if a house has a radon problem, and winter is an ideal time to test a home for radon.

Rebekah Shelton not dead: culprit of hoax "will pay"
Another replied to the message and said they would remember her as "one of the most lovable BB housemates". Of being abandoned after undergoing surgery, she said: "I wanted to kill myself, it was a nightmare".

Edge ST Revealed, Ford's First Performance SUV
Coinciding with the 2019 facelift for the US Ford Edge , Ford is introducing a performance ST variant for the first time. Ford will also fit unique 21-inch wheels to the Edge ST, to make sure it's not mistaken for the standard model.

United States advises citizens not to travel to Afghanistan
USA personnel had previously been allowed to fly to Ixtapa, the last place in Guerrero where they had been allowed to go. But an additional 11 Mexican states got a level 3 warning Wednesday, which urges people to "reconsider travel" there.

WikiLeaks founder Julian Assange granted Ecuadorian nationality
Were he to step one foot outside the embassy walls, he would find himself handcuffed and bundled away by the Metropolitan Police. Moreno issued a public demand that Assange not interfere in the politics of " nations that are our friends".

Moneygram Confirms Partnership with Ripple, XRP Price likely to Surge
As part of this agreement, both companies will also explore MoneyGram's integration into Ripple's ecosystem through xVia. About Ripple Ripple provides one frictionless experience to send money globally using the power of blockchain.