If you are using WhatsApp Web on a daily basis, you may want to stop doing that for a few days. A vulnerability in WhatsApp Web allows an attacker to completely take over your WhatsApp account and do everything that is possible to do from WhatsApp Web. This includes viewing older chats, pictures and videos, changing account details and even more.
A recent finding by Check Point Software Technologies Ltd. shows how such a data theft can be performed. Moreover, this can also be done using Telegram – another popular messaging app. The issue presently lies with the end-to-end encryption system.
To gain access to the system, the attacker will have to send a malicious, innocuous file to the victim. The victim will have to download the file and view it and the attacker will gain full control on the system. The attacker needs to fake a MIME type and craft it in an HTML file. Basically, the attacker needs to send an HTML file over to the victim, and the HTML file will contain a media file, such as an image or video embedded in it. While the user opens the HTML file, it will open in a new browser tab, and in the background tab, the attacker will have full control of the victim’s account.
You can watch the Proof of Concept video here:
After finding the flaw, Check Point alerted both WhatsApp and Telegram developers. Those who use WhatsApp Web or Telegram Web on a daily basis should either pause using it for the moment, or should frequently log in and out to make sure that no one can stay in your session for long.
More such security flaws are expected to pop up now since the WikiLeaks release on the CIA hacking tools. Security firms are now more aware about where to look for flaws in systems.