Just by sending a maliciously crafted message to a targeted group, an attacker can trigger a fully-destructive WhatsApp crash-loop, forcing all group members to completely uninstall the app, reinstall it, and remove the group to regain normal function.
Since the group members can't selectively delete the malicious message without opening the group window and re-triggering the crash-loop, they have to lose the entire group chat history, indefinitely, to get rid of it.
Discovered by researchers at Israeli cybersecurity firm Check Point, the latest bug resided in the WhatsApp's implementation of XMPP communication protocol that crashes the app when a member with invalid phone number drops a message in the group.
"When we attempt to send a message where the parameter 'participant' receives a value of 'null,' a 'Null Pointer Exception' is thrown," the researchers explain in a report shared with The Hacker News prior to its release.
"The parser for the participant's phone number mishandles the input when an illegal phone number is received. When it receives a phone number with a length, not in the ranger 5-20 or a non-digit character, it would read it as a 'null' string."
To be noted, the issue resided in both, WhatsApp for Android and iOS, but in an interview with The Hacker News, Check Point researcher Roman Zaikin confirmed that the exploit works smoothly against all vulnerable Android users, but sometimes doesn't reproduce on iOS.
The attack requires a malicious group member to manipulate other parameters associated with messages in a conversation that is otherwise protected using end-to-end encryption.
The WhatsApp manipulation tool is an extension for Burp Suite penetration testing software that allows users to intercept, decrypt, and re-encrypt their WhatsApp communication using their own encryption keys.
As shown in the video demonstration, the researchers used this setup to trigger the crash bug against all members of a group by simply replacing the participant's parameter from the sender's phone number to 'a@s.whatsapp.net,' an invalid non-digit phone number.
"The bug will crash the app, and it will continue to crash even after we reopen WhatsApp, resulting in a crash loop," the researchers say.
"Moreover, the user will not be able to return to the group and all the data that was written and shared in the group is now gone for good. The group cannot be restored after the crash has happened and will have to be deleted in order to stop the crash."
It should be noted that the attack would not affect the sender since the malicious message was injected in transit after it left the sender's device.
Check Point responsibly reported this crash bug to the WhatsApp security team back in late August this year, and the company patched the issue with the release of WhatsApp version 2.19.58 in mid-September.
The WhatsApp developers also "added new controls to prevent people from being added to unwanted groups to avoid communication with untrusted parties altogether."
"Because WhatsApp is one of the world's leading communication channels for consumers, businesses and government agencies, the ability to stop people using WhatsApp and delete valuable information from group chats is a powerful weapon for bad actors," Oded Vanunu, Check Point's Head of Product Vulnerability Research said.
"WhatsApp greatly values the work of the technology community to help us maintain strong security for our users globally. Thanks to the responsible submission from Check Point to our bug bounty program, we quickly resolved this issue for all WhatsApp apps in mid September," WhatsApp Software Engineer Ehren Kret told The Hacker News.
WhatsApp users are highly recommended to always keep their apps up-to-date in order to protect themselves against known attacks.
