The research identified a flaw that would allow a hacker to create a malicious group message to crash WhatsApp on users' devices and lead to the latest WhatsApp version being patched
Check Point Research, the Threat Intelligence arm of Check Point® Software Technologies Ltd., a leading global provider of cybersecurity solutions, recently helped mitigate a new vulnerability in WhatsApp that could allow a hacker to deliver a malicious group chat message that would crash the app for all group members. To regain access to WhatsApp, users will need to uninstall and reinstall it, then delete the group containing the message.
Oded Vanunu, Product Vulnerability Research Director at Check Point, said: “Because WhatsApp is one of the world’s leading communication channels for consumers, businesses and government agencies, the ability to stop users from using WhatsApp and delete valuable information from chat groups is a powerful weapon for hackers. All WhatsApp users should update to the latest version of the app to protect themselves from this potential attack.”
Check Point Research disclosed its findings to the WhatsApp bug bounty program on August 28, 2019. WhatsApp acknowledged the findings and deployed a fix to resolve the issue, which is available starting with WhatsApp version 2.18.5. Users will need to manually apply it to their devices. “WhatsApp responded quickly and responsibly to deploy mitigation against the exploitation of this vulnerability,” said Oded Vanunu.
“WhatsApp greatly appreciates the work of the tech community in helping us maintain strong security for our users worldwide,” said WhatsApp Software Engineer, Ehren Kret. “Thanks to Check Point’s responsible submission to Program , we quickly resolved this issue for all WhatsApp apps in mid-September. We also recently added new controls to prevent people from being added to unwanted groups, to prevent communication with all untrusted parties.”
The Check Point Research team found the vulnerability by monitoring communications between WhatsApp and WhatsApp Web, the web version of the app that mirrors all messages sent and received on a phone . This allowed the researchers to see the parameters used in WhatsApp communications and manipulate them. This new research builds on the “FakesApp” flaws discovered by Check Point Research, which allowed group chat messages to be manipulated to spread fake news.
WhatsApp has 1.5 billion users and more than a billion groups, making it the most popular direct messaging app in the world. Over 65 billion messages are sent via WhatsApp per day.
