The vulnerability lies in improper filtering of contact cards, sent utilizing the popular ‘vCard’ format. This includes images, videos, audio files, locations and contact cards. WhatsApp Web allows users to view any type of media or attachment that can be sent or viewed by the mobile platform/application. On August 27, WhatsApp rolled out the initial fix (in all versions greater than ) and blocked that particular feature. To make sure you are protected, update your WhatsApp Web right now.Ĭheck Point shared its discovery to WhatsApp on August 21, 2015. WhatsApp verified and acknowledged the security issue and have deployed the fix in web clients world-wide. To target an individual, all an attacker needs is the phone number associated with the account. Once opened, the alleged contact is revealed to be an executable file, further compromising computers by distributing bots, ransomware, RATs, and other malwares. All an attacker needed to do to exploit the vulnerability was to send a user a seemingly innocent vCard containing malicious code. At least 200M are estimated to use the WhatsApp Web interface, considering publicly available web traffic statistics.Ĭheck Point security researcher Kasif Dekel recently discovered significant vulnerabilities which exploit the WhatsApp Web logic and allow attackers to trick victims into executing arbitrary code on their machines in a new and sophisticated way. In September 2015, WhatsApp announced they had reached 900 million active users a month. WhatsApp Web is available for most WhatsApp supported platforms, including Android, iPhone (iOS), Windows Phone 8.x, BlackBerry, BB10 and Nokia smartphones. The web application mirrors all messages sent and received, and fully synchronize your phone and your desktop computer so that users can see all messages on both devices. WhatsApp Web is a web-based extension of the WhatsApp application on your phone.
0 kommentar(er)
