Short Bytes: The researchers at Check Point recently revealed a new attack targeting WhatsApp and Telegram. The web version of WhatsApp and Telegram could’ve had been hacked using a specially crafted image that directed users to a malicious URL for data snooping. Within 24 hours of reporting, the flaw was fixed by WhatsApp and Telegram.
WhatsApp is one of the most used instant messaging apps around. With its convenient messaging and useful features, it has grown to become the de facto messaging application in many countries. This popularity has also attracted the attention of notorious hackers who keep on devising new exploits.
In the recent development, the researchers at Check Point Security have announced a new type of attack against the web versions of WhatsApp and Telegram. This attack targets the way images and multimedia files are handled.
The researchers were able to devise a malicious image that appears normal in the preview but directed to an HTML page. After the user loads this page, all the locally stored data is retrieved.
By this “innocent-looking” picture, the attacker can gain control over the WhatsApp account, read message history, send messages on behalf of the user. This was possible as the local storage of the browser has WhatsApp session tokens that provide access to the user.
As the sent messages were encrypted without validation, the apps were blind to the content. This allowed the apps to prevent the malicious messages from being sent.
This vulnerability was reported to WhatsApp and Telegram on March 8th. Both the services have made changes and fixed the issue.
The Check Point team also outlines a couple of methods to make sure that you aren’t victims of such hacks. You are advised to periodically clean the logged-in PCs and avoid opening suspicious files and links.
Also Read: Hackers Use $5 Speakers To Control Smartphone And Fitbit Using Sound Waves
