Security researchers have discovered a vulnerability in the WhatsApp messaging app that could enable hackers to take control of a smartphone when it receives WhatsApp video call.
According to Natalie Silvanovich, a digital forensics expert at Google Project Zero, the problem is a "memory corruption bug in WhatsApp's non-WebRTC video conferencing implementation," she said in a tweet. This memory heap overflow problem could be caused by a hacker making a specially created malformed RTP (Real-time Transport Protocol) via WhatsApp video call request.
"Heap corruption can occur when the WhatsApp mobile application receives a malformed RTP packet," Silvanovich said in a vulnerability report. "This issue can occur when a WhatsApp user accepts a call from a malicious peer."
Essentially, hackers using this method could hijack a victim's phone if they simply answered a call, with the potential of remotely accessing a device's contents and WhatsApp conversations.
The vulnerability was found this August and affected both iPhone and Android versions of the app, but not the desktop version. According to the report, WhatsApp fixed the issue on September 28 in the Android client and on October 3 in the iPhone client.
In a statement to Reuters, WhatsApp said: "We routinely engage with security researchers from around the world to ensure WhatsApp remains safe and reliable. We promptly issued a fix to the latest version of WhatsApp to resolve this issue." The report added that WhatsApp had "no evidence that hackers actually exploited the bug to launch attacks".
However, in a tweet, Google Project Zero researcher, Tavis Ormandy, described the issue as a "big deal".
"Just answering a call from an attacker could completely compromise WhatsApp," he said. This means that an attacker would only need a phone number to hijack an account and eavesdrop on conversations.
However, Paul Bischoff, privacy advocate at Comparitech, told IT Pro that he was sceptical of the claim that this attack could allow a hacker to remotely take over the victim's device and access their conversations.
"The proof of concept describes a memory heap overflow that causes the app to crash due to memory corruption but does not indicate that it would allow remote hijacking," he said. "How could a hacker take over an app if it's just crashed?"
"That being said, WhatsApp has already patched the vulnerability, so users should be sure to update the app to prevent it from happening."
It comes just two months after the discovery of a separate vulnerability that allowed hackers to exploit its encryption method to manipulate messages and identities in group chats, although WhatsApp has denied this is evidence of a problem with end-to-end encryption.
-
Bigger salaries, more burnout: Is the CISO role in crisis?In-depth CISOs are more stressed than ever before – but why is this and what can be done?
-
Cheap cyber crime kits can be bought on the dark web for less than $25News Research from NordVPN shows phishing kits are now widely available on the dark web and via messaging apps like Telegram, and are often selling for less than $25.
-
Should your business start a bug bounty program?In-depth Big tech firms including Google, Apple and Microsoft offer bug bounty programs, but can they benefit smaller businesses too?
-
OpenAI to pay up to $20k in rewards through new bug bounty programNews The move follows a period of unrest over data security concerns
-
Windows 11 System Restore bug preventing users from accessing appsNews Microsoft has issued a series of workarounds for the issue which is affecting a range of apps including Office and Terminal
-
Windows 10 users encounter ‘blue screen of death’ after latest Patch Tuesday updateNews Microsoft said it is working on a fix for the issue and has offered users a temporary workaround
-
SpaceX bug bounty offers up to $25,000 per Starlink exploitNews The spacecraft manufacturer has offered white hats immunity to exploit a wide range of Starlink systems, with a dedicated report page
-
Microsoft announces lucrative new bug bounty awards for M365 products and servicesNews The new awards will focus on scenario-based weaknesses and offer bonuses of up to 30% for the most severe bugs
-
Adobe forced to patch its own failed security updateNews Company issues new fix for e-commerce vulnerability after researchers bypass the original update
-
Google doubles bug bounty rewards for Linux, Kubernetes exploitsNews The increased rewards are said to align better with the community's expectations of a bug bounty programme of this kind
