The Hacker News - Cybersecurity News and Analysis: hacking WhatsApp

WhatsApp, the world's most popular end-to-end encrypted messaging application, patched an incredibly frustrating software bug that could have allowed a malicious group member to crash the messaging app for all members of the same group, The Hacker News learned. Just by sending a maliciously crafted message to a targeted group, an attacker can trigger a fully-destructive WhatsApp crash-loop, forcing all group members to completely uninstall the app, reinstall it, and remove the group to regain normal function. Since the group members can't selectively delete the malicious message without opening the group window and re-triggering the crash-loop, they have to lose the entire group chat history, indefinitely, to get rid of it. Discovered by researchers at Israeli cybersecurity firm Check Point , the latest bug resided in the WhatsApp's implementation of XMPP communication protocol that crashes the app when a member with invalid phone number drops a message in the grou

Finally, for the very first time, an encrypted messaging service provider is taking legal action against a private entity that has carried out malicious attacks against its users. Facebook filed a lawsuit against Israeli mobile surveillance firm NSO Group on Tuesday, alleging that the company was actively involved in hacking users of its end-to-end encrypted WhatsApp messaging service. Earlier this year, it was discovered that WhatsApp had a critical vulnerability that attackers were found exploiting in the wild to remotely install Pegasus spyware on targeted Android and iOS devices. The flaw (CVE-2019-3568) successfully allowed attackers to silently install the spyware app on targeted phones by merely placing a WhatsApp video call with specially crafted requests, even when the call was not answered. Developed by NSO Group, Pegasus allows access to an incredible amount of data from victims' smartphones remotely, including their text messages, emails, WhatsApp chats,

Cybercriminals are known to take advantage of everything that's popular among people in order to spread malware, and Google's official Play Store has always proved no less than an excellent place for hackers to get their job done. Yesterday some users spotted a fake version of the most popular WhatsApp messaging app for Android on the official Google Play Store that has already tricked more than one million users into downloading it. Dubbed Update WhatsApp Messenger , came from an app developer who pretended to be the actual WhatsApp service with the developer title "WhatsApp Inc."—the same title the actual WhatsApp messenger uses on Google Play. You might be wondering how the sneaky app developer was able to use the same title as the legitimate Facebook-owned maker of the messaging client—thanks to a Unicode character space. The app maker added a Unicode character space after the actual WhatsApp Inc. name, which in computer code reads WhatsApp+Inc%C2%A0 .

Are you sure the version of WhatsApp, or Skype, or VLC Player installed on your device is legitimate? Security researchers have discovered that legitimate downloads of several popular applications including WhatsApp, Skype, VLC Player and WinRAR have reportedly been compromised at the ISP level to distribute the infamous FinFisher spyware also known as FinSpy. FinSpy is a highly secret surveillance tool that has previously been associated with British company Gamma Group, a company that legally sells surveillance and espionage software to government agencies across the world. The spyware has extensive spying capabilities on an infected computer, including secretly conducting live surveillance by turning ON its webcams and microphones, recording everything the victim types with a keylogger, intercepting Skype calls, and exfiltration of files. In order to get into a target's machine, FinFisher usually uses various attack vectors, including spear phishing, manual installat

Next time when someone sends you a photo of a cute cat or a hot chick on WhatsApp or Telegram then be careful before you click on the image to view — it might hack your account within seconds. A new security vulnerability has recently been patched by two popular end-to-end encrypted messaging services — WhatsApp and Telegram — that could have allowed hackers to completely take over user account just by having a user simply click on a picture. The hack only affected the browser-based versions of WhatsApp and Telegram, so users relying on the mobile apps are not vulnerable to the attack. According to Checkpoint security researchers, the vulnerability resided in the way both messaging services process images and multimedia files without verifying that they might have hidden malicious code inside. For exploiting the flaw, all an attacker needed to do was sending the malicious code hidden within an innocent-looking image. Once the victim clicked on the picture, the attacker coul

WhatsApp has introduced a new security feature that fixes a loophole in the popular messaging platform, which if exploited, could allow an attacker to hijack victim's account with just knowing the victim's phone number and some hacking skills. The attack does not exploit any vulnerability in WhatsApp; instead, it relies on the way the account setup mechanism works. WhatsApp allows users to sign up to the app using their phone number, so if an attacker wants to hijack your WhatsApp account, they would require an OTP (One time password) send to your phone number. The attacker can grab this OTP by diverting the SMS containing the passcode to their own computer or phone, using either a malicious app or SS7 vulnerability , and then log into the victim's WhatsApp account. The attack even works in case the phone is locked. In August, Iranian state-sponsored hackers reportedly hijacked over dozens of Telegram accounts belonging to activists and journalists by exploiting a

Raise your hands if you want Free Video Calling feature in WhatsApp. I am in, and I think most of you people. And the good news is that it looks like WhatsApp's much-awaited Free Video Calling feature is on its way, according to the recently leaked screenshots. Free Video Calling Feature in WhatsApp German technology blog Macerkopf.de has posted what it claims are screenshots from an unreleased version of the popular messaging client WhatsApp for iOS. The screenshots are from an unreleased version of the software ( version 2.12.16.2 ), which is currently being tested internally, but at present it is not clear whether or not those screenshots are legitimate. But, if the leaked screenshots are real, and WhatsApp adds the Free Video Calling feature , then the company could take an enormous bite out of some of its top rival. WhatsApp Video Calling feature will allow you to make video calls to your friends and family anywhere in the world for free as l

While the Indian people continue to struggle for Net Neutrality, a new problem surrounded them with the release of the latest policy for ' National Encryption Policy ' by the Indian Government. If you delete your WhatsApp Messages or Emails that you receive or send before 90 days, it might be a crime and you can End-up In Jail. If the new National Encryption Policy implements that come up with weird suggestions — one should not delete WhatsApp conversation, Gmail or any email for 90 days, it would be an Internet Disaster. With the aim to 'provide confidentiality of information' and ensure 'protection of sensitive or proprietary information', the draft policy, proposed by an so-called ' expert panel ' from the Department of Electronics and Information Technology ( DeitY ) , requires: Access to your Private Data The government wants to have access to all your encrypted information including your personal emails, text and voice messages, and data stored in a privat

We are once again here with our weekly round up based on last week's top cyber security threats and challenges. I recommend you to read the entire thing ( just click ' Read More ' because there's some valuable advice in there as well ). Here's the list: 1. Reminder! If You have not yet, Turn Off Windows 10 Keylogger Now Microsoft is very powerful in tracking every single word you type or say to its digital assistant Cortana using its newest Windows 10 operating system. The keylogger that Microsoft put in the  Technical Preview of Windows 10  last fall made its way to  Windows 10 Free  public release first rolled out back in July. Besides various  Windows 10 privacy issues , there is a software component that is a bit more complicated than you thought. It tracks your inputs using: Keyboard Voice Screen Mouse Stylus Information about your Calendar and Contacts If this keylogger, which is more than just a keylogger, makes you feel creepy then need

WhatsApp recently claimed to have hit 900 Million monthly active users , but a dangerous security flaw in the web version of the popular instant messaging app puts up to 200 Million of its users at risk . Yes, the web-based extension of WhatsApp is vulnerable to an exploit that could allow hackers to trick users into downloading malware on their computers in a new and more sophisticated way. WhatsApp made its web client, WhatsApp Web , available to iPhone users just last month, after first rolling out its web-based instant messaging service for Android, Windows and BlackBerry Phone earlier in the year. Similar to Facebook Messenger, WhatsApp Web is an effective way to experience the mobile app in a web browser, allowing you to view all of the conversations you have made with your friends – including images, audio files, videos, GPS location and contact cards – straight on your PCs. However, a security flaw discovered by Check Point's security researcher Kasif

If you rely on messaging apps to remain in contact with your family members and friends, then you may have to switch back to old-fashioned text messaging service in matter of weeks due to a new law currently going through Parliament. WhatsApp and Facebook Messenger to Ban in UK The popular messaging applications, including WhatsApp, Snapchat, iMessage and Facebook Messenger, could all potentially be banned in the UK under the controversial ' Snoopers Charter '. The Investigatory Powers Bill -- the so-called Snoopers Charter -- mentioned in the 2015 Queen's Speech , would allow UK government to eradicate instant messaging apps that refuse to switch off end-to-end encryption from their services. Earlier this year in light of the Charlie Hebdo shootings in Paris, Prime Minister David Cameron hinted at the crackdown when he claimed that he would ban encrypted messaging apps like Snapchat, WhatsApp and Messenger unless they didn't comply with new surve

The Electronic Frontier Foundation has released its annual report card of tech companies for 2015 based upon how much they keep your personal data secure from government snoops. And the Worst Companies Award goes to… At&T WhatsApp Verizon Yes, you heard right! WhatsApp is one of the three worst companies at protecting its users' data so if you are concerned about your data privacy, you should think twice before using WhatsApp. The EFF released its latest Who Has Your Back report based on 5 basic criteria that included: Follows Industry Accepted Best Practices Tells Users About Government Data Demands Discloses Policies on Data Retention Discloses Government Content Removal Requests Pro-user Public Policy: opposes backdoors The prominent privacy advocacy group analysed 24 companies in total, and among them AT&T, Verizon and WhatsApp came out to be the worst companies at protecting its users' data. Where Verizon met two criteria of the EFF&#

The hugely popular smartphone messaging service WhatsApp, acquired by Facebook for over $20 billion last year, has reportedly been found to be prone to hijacking without unlocking or knowing your device password, making its hundreds of Millions of users vulnerable to, not just hackers, but also non-technical people. This trick lets anyone surrounds you to get effectively control over your WhatsApp account. The attacker needs nothing more than a phone number of the target person and access to the target mobile phone for a few seconds, even if it is locked. Hacking Whatsapp account in such scenario is not hard for your friends and colleagues. This is not actually a loophole or vulnerability in WhatsApp, and rather it is just the way WhatsApp is designed and its account setup mechanism works. NOTE: Moreover, we aren't encouraging users to hack others WhatsApp account , but the purpose of publishing this article is to warn and remind our readers that you should be extr

After rolling out WhatsApp's Free Voice Calling feature for Android users late last month, the widely popular messaging service has started to roll out the feature to iOS users. Now iOS users can enjoy making free voice calls through WhatsApp, as the new version of the messenger is now live in the iOS App Store with support to calling. WhatsApp calling feature allows you to call your friends and family anywhere in the world for free as long as you have a Wi-Fi network or a working data plan on your registered number. The full description of the WhatsApp Calling feature on the App Store page reads: " Call your friends and family using WhatsApp for free, even if they are in another country. WhatsApp calls use your phone's Internet connection rather than your cellular plan's voice minutes (Data charges may apply) Note: WhatsApp Calling is rolling out slowly over the next several weeks. " The last line indicates that the feature, so far, is not actually a

Pebble, a wristwatch that can connect to your phone - both iOS and Android - and interact with apps, has a hard-coded vulnerability that allows a remote attacker to destroy your Smartwatch completely. Pebble Smartwatch , developed and released by Pebble Technology Corporation in 2013, is considered as one of the most popular SmartWatches that had become the most funded project in the history of Kickstarter. Just two hours after its crowd-funding campaign launched, Pebble had already surpassed its $100,000 goal and at last had reached over $10.25 million pledged by nearly 70,000 Kickstarter backers. A security enthusiast Hemanth Joseph  claimed to have found that his Pebble SmartWatch with the latest v2.4.1 Firmware can be remotely exploited by anyone with no technical knowledge in order to delete all data stored in the device, apps, notes, and other information stored in it. HOW PEBBLE SMARTWATCH WORKS Before proceeding towards how he did this, let me explain how Peb

If you are using WhatsApp to chit-chat with your friends or relatives, then you should be careful about sharing your location with them using WhatsApp 'Location Share' feature. No doubt, WhatsApp communication between your phone and company's server is now encrypted with SSL, which means whatever you are sharing with your friends, is secured from the man-in-the-middle attacks . But the extremely popular instant messaging service for Smartphones that delivers more than 1 billion messages per day has another serious security issue. According to Researchers at UNH Cyber Forensics Research & Education Group , WhatsApp location sharing service could expose your location to hackers or Spy Agencies. While sharing the location on WhatsApp users need to first locate themselves on Google Map within the app window, as shown:  Once selected, WhatsApp fetches the location and thumbnail (an image) from the Google Map service to share it as the message icon, but unfortunately Wh

Popular Smartphone Messaging app  WhatsApp 's $19 billion acquisition by Social Network giant Facebook  made Headlines this week. While Some are applauding the move, and many other users are worried about WhatsApp's future and their privacy after this acquisition. Why So Serious? WhatsApp currently having 450 million active users and processes 50 billion messages a day. Service charges a nominal service fee of $1/year, that means Facebook is buying at $42.22 per user. $19 Billion / 450 million users  = $42.22 per user These figures show ,  obviously future revenue from WhatsApp can't cover the acquisition cost in the short or mid-term. " You can still count on absolutely no ads interrupting your communication. There would have been no partnership between our two companies if we had to compromise on the core principles that will always define our company, our vision and our product. " WhatsApp founder said in a  blog post . So, What Facebook is