#1 Trusted Cybersecurity News Platform Followed by 3.45+ million
The Hacker News Logo
Subscribe to Newsletter

Search results for Messenger | Breaking Cybersecurity News | The Hacker News

Peerio — End-to-End Encrypted Secure Messenger and File Sharing App

Peerio — End-to-End Encrypted Secure Messenger and File Sharing App

Jan 15, 2015
On one end, where governments of countries like U.K is criticizing end-to-end encryption and considering to ban the encrypted communication apps like Snapchat, CryptoCat, WhatsApp and Apple's iMessage. On the other hand, the Internet community has come up with a new and rather more secure encrypted communication app. Dubbed Peerio , an " encrypted productivity suite " designed to offer much more usable alternative to PGP email and file encryption, so that every individual user and business can encrypt everything from Instant Messages to online file storage. Peerio, released on Wednesday, is designed by 24-year-old Nadim Kobeissi – the creator of the end-to-end encrypted group messaging app Cryptocat and the encrypted file-sharing app MiniLock . " With Peerio everything you share or communicate with your team is secured with state-of-the-art encryption , and it's as easy as using Gmail. You don't need to learn to use it, " Kobeissi told Wired. &quo
iOS URL Scheme Could Let App-in-the-Middle Attackers Hijack Your Accounts

iOS URL Scheme Could Let App-in-the-Middle Attackers Hijack Your Accounts

Jul 15, 2019
Security researchers have illustrated a new app-in-the-middle attack that could allow a malicious app installed on your iOS device to steal sensitive information from other apps by exploiting certain implementations of Custom URL Scheme . By default on Apple's iOS operating system, every app runs inside a sandbox of its own, which prevent all apps installed on the same device from accessing each other's data. However, Apple offers some methods that facilitate sending and receiving very limited data between applications. One such mechanism is called URL Scheme, also known as Deep Linking, that allows developers to let users launch their apps through URLs, like facetime:// , whatsapp:// , fb-messenger:// . For example, when you click "Sign in with Facebook" within an e-commerce app, it directly launches the Facebook app installed on your device and automatically process the authentication. In the background, that e-commerce app actually triggers the URL Sch
World's most secure messaging service offers £10,000 if you crack it

World's most secure messaging service offers £10,000 if you crack it

May 01, 2013
Privacy conscious phone users are being offered a new app that claims to be the world's first totally secure messaging service. A London-based iPhone messaging app claims to be unhackable and is offering reward to anyone who can intercept a message sent by it.  Redact believes that messages sent via the app are completely secure, and to prove it a reward of £10,000 has been offered. The application creates a secure and encrypted peer-to-peer network between two iPhones, with messages sent directly from one phone to another and not through the company's servers.  The company has already offered its Secure Messenger service for free to MPs and submitted the technology to CESG, the Government's National Technical Authority for Information Assurance, which provides advice on the security of communications and electronic data. With Redact there are no user names, phone numbers or email addresses. Instead, new users are automatically assigned a unique PIN, simi
Twitter is Testing End-to-End Encrypted Direct Messages

Twitter is Testing End-to-End Encrypted Direct Messages

May 08, 2018
Twitter has been adopting new trends at a snail's pace. But it's better to be late than never. Since 2013 people were speculating that Twitter will bring end-to-end encryption to its direct messages, and finally almost 5 years after the encryption era began, the company is now testing an end-to-end encrypted messaging on Twitter. Dubbed " Secret Conversation ," the feature has been spotted in the latest version of Android application package (APK) for Twitter by Jane Manchun Wong, a computer science student at the University of Massachusetts Dartmouth. End-to-end encryption allows users to send and receive messages in a way that no one, be it an FBI agent with a warrant, hacker or even the service itself, can intercept them. However, it seems like the Secret Conversation feature has currently been available only to a small number of users for testing. So, if you are one of those lucky ones, you will be able to send end-to-end encrypted Secret Conversation thro
Breaking — India Bans Facebook's Free Basics Service

Breaking — India Bans Facebook's Free Basics Service

Feb 08, 2016
Facebook's Free Basics Internet service has been Blocked in India. The Telecom Regulatory Authority of India (TRAI) has banned mobile carriers and broadband providers to charge customers based on what services or content they access over the Internet. Under Prohibition of Discriminatory Tariffs for Data Services Regulations, 2016, "no service provider shall offer or charge discriminatory tariffs for data services on the basis of content." With this, Facebook's Free Basics is dead in India. All Zero-Rated Internet Services are BLOCKED!  It is not just Facebook's Free Basics Internet program that has been blocked inside the country, but also the zero-rated internet services altogether. Zero-rated internet services means those services that allow people access to some websites and web services without utilizing any of their mobile data allowance. Under the new regulation, no such services are now allowed. Free Basics (previously known by Int
New Settings Let Hackers Easily Pentest Facebook, Instagram Mobile Apps

New Settings Let Hackers Easily Pentest Facebook, Instagram Mobile Apps

Mar 26, 2019
Facebook has introduced a new feature in its platform that has been designed to make it easier for bug bounty hunters to find security flaws in Facebook, Messenger, and Instagram Android applications. Since almost all Facebook-owned apps by default use security mechanisms such as Certificate Pinning to ensure integrity and confidentiality of the traffic, it makes it harder for white hat hackers and security researchers to intercept and analyze network traffic to find server-side security vulnerabilities. For those unaware, Certificate Pinning is a security mechanism designed to prevent users of an application from being a victim of network-based attacks by automatically rejecting the whole connection from sites that offer bogus SSL certificates. Dubbed " Whitehat Settings ," the new option now lets researchers easily bypass Certificate Pinning on the Facebook-owned mobile apps by: Disabling Facebook's TLS 1.3 support Enabling proxy for Platform API requests
Facebook Worm Spreads Through Yahoo! Messenger !

Facebook Worm Spreads Through Yahoo! Messenger !

Dec 23, 2010
A computer worm is on the loose that denies Facebook users access to their accounts. The worm, dubbed " W32.Yimfoca " by the security company Symantec, is being spread through Yahoo! Messenger and specifically targets Facebook users, forcing them to fill out surveys before they can log on to their profile pages. First, the worm sends an instant message to users that includes a corrupted link. When a user clicks the link, the worm installs malware on their system. Later, when users visit the Facebook homepage, they are met with a message reading, "Your account is suspended. To make your account active you need to complete one of these surveys," followed by a list of six options, including "Test Your Celebrity IQ here," and "Win a FREE iPhone 4." If you decide to fill out one of the surveys, another box appears reading, "You have only 3 minutes to fill out the selected survey or you will not have access to your account." Each time a
Facebook Collected Your Android Call History and SMS Data For Years

Facebook Collected Your Android Call History and SMS Data For Years

Mar 25, 2018
Facebook knows a lot about you, your likes and dislikes—it's no surprise. But do you know, if you have installed Facebook Messenger app on your Android device, there are chances that the company had been collecting your contacts, SMS, and call history data at least until late last year. A tweet from Dylan McKay, a New Zealand-based programmer, which received more than 38,000 retweets (at the time of writing), showed how he found his year-old data—including complete logs of incoming and outgoing calls and SMS messages—in an archive he downloaded (as a ZIP file) from Facebook. Facebook was collecting this data on its users from last few years, which was even reported earlier in media, but the story did not get much attention at that time. Since Facebook had been embroiled into controversies over its data sharing practices after the Cambridge Analytica scandal last week, tweets from McKay went viral and has now fueled the never-ending privacy debate. A Facebook spokespe
Facebook M: Facebook's Answer to Siri, Cortana and Google Now

Facebook M: Facebook's Answer to Siri, Cortana and Google Now

Aug 27, 2015
Microsoft's 'Cortana', Google's 'Google Now', Apple's 'Siri', Now meet Facebook's 'M.' Facebook's announcement to introduce their Personal Digital Assistant "M" comes with powers within the Facebook Messenger. It is a similar virtual assistant like Google Now, Apple's Siri and Microsoft's smart digital assistant Cortana. It seems that all the intelligence that resides within the personal digital assistants already in the market are nothing in front of M's capabilities, according to the Facebook post by David Marcus , Vice President of Messaging Products at Facebook. Three days ago, Microsoft had boosted the powers of Android users by making Cortana accessible on Android devices. Now listening to Facebook's launch of 'M', rival companies would have definitely face-palmed! What Can I Help You With? The virtual assistant software "M" is truly going to support you by doing the
New Web-Based Credit Card Stealer Uses Telegram Messenger to Exfiltrate Data

New Web-Based Credit Card Stealer Uses Telegram Messenger to Exfiltrate Data

Sep 02, 2020
Cybercriminal groups are constantly evolving to find new ways to pilfer financial information, and the latest trick in their arsenal is to leverage the messaging app Telegram to their benefit. In what's a new tactic adopted by Magecart groups, the encrypted messaging service is being used to send stolen payment details from compromised websites back to the attackers. "For threat actors, this data exfiltration mechanism is efficient and doesn't require them to keep up infrastructure that could be taken down or blocked by defenders," Jérôme Segura of Malwarebytes said in a Monday analysis . "They can even receive a notification in real time for each new victim, helping them quickly monetize the stolen cards in underground markets." The TTP was first publicly documented by security researcher @AffableKraut in a Twitter thread last week using data from Dutch cybersecurity firm Sansec. Injecting e-skimmers on shopping websites by exploiting a known
Crypto Miners Using Tox P2P Messenger as Command and Control Server

Crypto Miners Using Tox P2P Messenger as Command and Control Server

Aug 24, 2022
Threat actors have begun to use the Tox peer-to-peer instant messaging service as a command-and-control method, marking a shift from its earlier role as a contact method for ransomware negotiations. The findings from Uptycs, which analyzed an Executable and Linkable Format (ELF) artifact (" 72client ") that functions as a bot and can run scripts on the compromised host using the Tox protocol. Tox is a  serverless protocol  for online communications that offers end-to-end encryption (E2EE) protections by making use of the Networking and Cryptography library ( NaCl , pronounced "salt") for encryption and authentication. "The binary found in the wild is a stripped but dynamic executable, making decompilation easier," researchers Siddharth Sharma and Nischay Hedge  said . "The entire binary appears to be written in C, and has only  statically linked  the c-toxcore library." It's worth noting that c-toxcore is a  reference implementation  of
WhatsApp to Share your Personal Data With Facebook

WhatsApp to Share your Personal Data With Facebook

Jan 30, 2016
Recently the Facebook-owned messaging app dropped its $1 annual subscription fee to make WhatsApp Free for Lifetime . Now, WhatsApp has plans to introduce a new feature that would allow its users to integrate their Facebook accounts with the most widely used messaging app. So far, the social media giant has been focusing on its own messaging platform, Messenger and both WhatsApp and Facebook have been working separately in terms of adding new features. WhatsApp to Share User Data With Facebook Android developer Javier Santos spotted a new feature in the latest beta build of WhatsApp, which indicates that soon you'll start seeing some features interconnected between WhatsApp and Facebook. The feature (optional, for now), dubbed " Share my account info ," when selected will share your personal WhatsApp account information with Facebook in order "to improve your Facebook experience," according to the description. Although it's uncle
75,000 Turks Arrested So Far for Downloading Encrypted Messaging App

75,000 Turks Arrested So Far for Downloading Encrypted Messaging App

Sep 15, 2017
WARNING: If you are Turkish and using or have installed ByLock —a little-known encrypted messaging app—you could be detained by Turkish authorities. You might be thinking why??? Because using this app in Turkish is illegal since last year. The background story begins here... Remember the deadliest Turkey's failed coup attempt? In July 2016, a section of the Turkish military launched a coordinated operation—by deploying soldiers, tanks on the streets of major Turkish cities—to topple the government and unseat President Recep Tayyip Erdogan . The Turkish government blamed Muhammed Fethullah Gülen, a Turkish preacher who lives in the United States, for leading the July 15-16 attempted coup , though Gülen denied any involvement. In the aftermath of the coup attempt, Milli İstihbarat Teşkilatı (MİT), the Turkish intelligence agency investigated and found that the ByLock messaging app was used as a communication tool by tens of thousands of Gülen movement followers to c
Why Facebook is buying WhatsApp for $19 Billion?

Why Facebook is buying WhatsApp for $19 Billion?

Feb 21, 2014
Popular Smartphone Messaging app  WhatsApp 's $19 billion acquisition by Social Network giant Facebook  made Headlines this week. While Some are applauding the move, and many other users are worried about WhatsApp's future and their privacy after this acquisition. Why So Serious? WhatsApp currently having 450 million active users and processes 50 billion messages a day. Service charges a nominal service fee of $1/year, that means Facebook is buying at $42.22 per user. $19 Billion / 450 million users  = $42.22 per user These figures show ,  obviously future revenue from WhatsApp can't cover the acquisition cost in the short or mid-term. " You can still count on absolutely no ads interrupting your communication. There would have been no partnership between our two companies if we had to compromise on the core principles that will always define our company, our vision and our product. " WhatsApp founder said in a  blog post . So, What Facebook is
How to Crash Your Friends' WhatsApp Just By Sending Crazy Smileys

How to Crash Your Friends' WhatsApp Just By Sending Crazy Smileys

Dec 22, 2015
What would require crashing the wildly popular WhatsApp messaging application? Nearly 4000 Smileys . Yes, you can crash your friends'  WhatsApp , both WhatsApp Web and mobile application, by sending them not any specially crafted messages, but just Smileys. Indrajeet Bhuyan , an independent researcher, has reported The Hacker News a new bug in WhatsApp that could allow anyone to remotely crash most popular messaging app just by sending nearly 4000 emojis to the target user, thereby affecting up to 1 Billion users. Bhuyan is the same researcher who reported a very popular WhatsApp crash bug last year that required 2000 words ( 2kb in size ) message in the special character set to remotely crash Whatsapp messenger app. After this discovery, the company patched the bug by setting up the limits of characters in WhatsApp text messages, but unfortunately, it failed to set up limits for smileys send via WhatsApp. "In WhatsApp Web, Whatsapp allows 65500-660
WhatsApp Blocks Links to Telegram Messenger (Its biggest Competitor)

WhatsApp Blocks Links to Telegram Messenger (Its biggest Competitor)

Dec 01, 2015
It seems like Facebook-owned popular messaging service WhatsApp is blocking links to rival messaging applications – at least Telegram app  for now. Telegram users are noticing that WhatsApp is blocking any links to the privacy-oriented messaging service Telegram.me. Although users are free to send or receive Telegram links on WhatsApp, the links appear as non-clickable that you cannot copy or forward. This strange behavior was first noticed this morning by Telegram users over on Reddit. The URLs – which are generally automatically made clickable – still appeared as plain text messages, but they didn't register as hyperlinks, blocking users from copying or forwarding them to other users or other apps. Read Also: How to Auto-BackUp Your WhatsApp Data to Google Drive with Encryption . In general, this odd behavior is done with malicious URLs such as malware or spam. The Culprit However, this strange behavior was not exhibited on every device. Only W
India temporarily Bans Facebook's Free Internet Service

India temporarily Bans Facebook's Free Internet Service

Dec 24, 2015
Facebook's Free Internet access to India has hit a hurdle: The Telecom Regulatory Authority of India ( TRAI ) has ordered the mobile carrier to temporary suspend the Facebook's Free Basics Internet program. Facebook's Free Basics is an app that allows users to access certain Internet websites, including Facebook, for free. However, India's independent regulatory body has asked Reliance Communications – the only mobile carrier that provides Free Basics in India – to disable the free internet service temporarily while the regulator investigates whether the service violates net neutrality . Facebook's Free Basics – Free Internet for ALL Facebook introduced Free Basics ( then known as Internet.org ) app to India in February this year, offering people access to more than three dozen Web services for free. Users of Facebook's Free Basics app must have a Reliance mobile network and are limited to a range of portals including Wikipedia, BBC New
Beware of Windows/MacOS/Linux Virus Spreading Through Facebook Messenger

Beware of Windows/MacOS/Linux Virus Spreading Through Facebook Messenger

Aug 24, 2017
If you came across any Facebook message with a video link sent by anyone, even your friend — just don't click on it. Security researchers at Kaspersky Lab have spotted an ongoing cross-platform campaign on Facebook Messenger, where users receive a video link that redirects them to a fake website, luring them to install malicious software. Although it is still unclear how the malware spreads, researchers believe spammers are using compromised accounts, hijacked browsers, or clickjacking techniques to spread the malicious link. The attackers make use of social engineering to trick users into clicking the video link, which purports to be from one of their Facebook friends, with the message that reads "< your friend name > Video" followed by a bit.ly link, as shown. Here's How this Cross-Platform Malware Works: The URL redirects victims to a Google doc that displays a dynamically generated video thumbnail, like a playable movie, based on the sender'
Hackers Tampered With APKPure Store to Distribute Malware Apps

Hackers Tampered With APKPure Store to Distribute Malware Apps

Apr 10, 2021
APKPure, one of the largest alternative app stores outside of the Google Play Store, was infected with malware this week, allowing threat actors to distribute Trojans to Android devices. In a supply-chain attack similar to that of German telecommunications  equipment manufacturer Gigaset , the APKPure client version 3.17.18 is said to have been tampered with in an attempt to trick unsuspecting users into downloading and installing malicious applications linked to the malicious code built into the APKpure app. The development was reported by researchers from  Doctor Web  and  Kaspersky . "This trojan belongs to the dangerous Android.Triada malware family capable of downloading, installing and uninstalling software without users' permission," Doctor Web researchers said. According to Kaspersky, the APKPure version 3.17.18 was tweaked to incorporate an advertisement SDK that acts as a Trojan dropper designed to deliver other malware to a victim's device. "This
Vulnerability in Whatsapp messenger media server

Vulnerability in Whatsapp messenger media server

Jun 12, 2013
If you own an iPhone or an Android device, then the chances are high that you're familiar with the extremely popular cross-platform messaging app, WhatsApp. According to a whitehat hacker Mohammed Saeed , Whatsapp media server ( media.whatsapp.com ) interface was vulnerable to Traversal local file inclusion. This vulnerability occurs when a page include is not properly sanitized, and allows directory traversal characters to be injected. Flaw allowed hacker to gather usernames via an " /etc/passwd " file and also another sensitive files like log files i.e   "/apache/logs/error.log" or " /apache/logs/access.log ". Flaw was reported by Mohammed with proof of conpect to Whatsapp security team on 27th May and was addressed this week. If you are also penetration tester and have something buggy that can help Whatsapp team to make there service more secure, feel free to contact them at  support@whatsapp.com .
More Resources

Sign up for free and start receiving your daily dose of cybersecurity news, insights and tips.