WhatsApp Fixes Flaw That Could Have Led to Exposure of User Data

WhatsApp has patched a vulnerability that might enable an attacker to learn delicate info from the app’s reminiscence, together with personal messages utilizing a specifically crafted picture. The vulnerability was reported to WhatsApp by cybersecurity agency Test Level Analysis, and it existed throughout the picture filter perform of WhatsApp for Android and WhatsApp Enterprise for Android that permits customers so as to add filters to their photographs. The Fb-owned firm mounted the safety difficulty after it was reported by Test Level researchers and claimed that there was no proof that the vulnerability was ever abused.

Known as “Out-Of-Bounds read-write vulnerability”, the problem was disclosed to WhatsApp by Check Point Research on November 10, 2020. WhatsApp took a while in fixing the bug and issued a patch in February. It was offered to finish customers by means of the model 2.21.1.13 of each WhatsApp for Android and WhatsApp Business for Android apps.

Researchers at Test Level Analysis had been in a position to uncover the vulnerability that’s technically a reminiscence corruption difficulty whereas wanting on the method WhatsApp processes and sends photographs on its platform. Throughout the analysis, it was discovered that the picture filter perform of the messaging app crashes when it was used with some specially-designed GIF information. That introduced the researchers to the purpose from the place they had been in a position to spot the loophole.

Based on Test Level Analysis, the vulnerability may very well be triggered after a consumer opens an attachment containing a maliciously crafted picture file, tries to use a filter, after which sends the picture with the filter utilized again to the attacker. The researchers, thus, famous that hackers would have required “advanced steps and intensive consumer interplay” to take advantage of the problem.

Nonetheless, if it may very well be efficiently exploited, the vulnerability is claimed to permit hackers to learn delicate info from WhatsApp reminiscence that embody personal messages and beforehand shared photographs and movies.

“As soon as we found the safety vulnerability, we rapidly reported our findings to WhatsApp, who was cooperative and collaborative in issuing a repair. The results of our collective efforts is a safer WhatsApp for customers worldwide,” stated Oded Vanunu, Head of Merchandise Vulnerabilities Analysis at Test Level, in a ready assertion.

WhatsApp has listed the main points of the vulnerability on its safety advisories web site as CVE-2020-1910. The platform added two new checks on supply and filter photographs to limit reminiscence entry.

“Folks shouldn’t have any doubt that end-to-end encryption continues to work as meant and other people’s messages stay secure and safe,” WhatsApp stated in its assertion given to Test Level Analysis. “This report entails a number of steps a consumer would have wanted to take and we have now no motive to imagine customers would have been impacted by this bug. That stated, even probably the most advanced eventualities researchers establish may help improve safety for customers.”

WhatsApp additionally really helpful its customers to maintain their apps and working techniques updated, obtain updates every time they’re accessible, report suspicious messages, and attain out on to its group in the event that they expertise points utilizing WhatsApp.