The researchers discovered that users’ data is stored in an unencrypted form on the Viber Amazon Servers. According the researchers images and videos of any Viber user could be easily accessed without any authentication, an attacker can simply intercept a link from Viber, in a classic MITM attack scenario, users to access victim’s data.

In the following image is reproduced a typical attack scenario on Viber user, it is easy to understand that an attacker can use any network testing tool available on the market, such as NetworkMiner, Wireshark, and NetWitness, to sniff the Viber traffic.

“Anyone, including the service providers will be able to collect this information – and anyone that sets up a rogue AP, or any man-in-the middle attacks such as ARP poisoning will be able to capture this unencrypted traffic and view the images and videos received as well as the locations being sent or received by a phone.” said Professor Ibrahim Baggili and Jason Moore .

In a video, the researchers demonstrated that Viber is not encrypting any data such as images, doodles, videos and location images while exchanging it with their Amazon server, that allows an attacker to capture this unencrypted traffic with man-in-the middle attack.

The researchers have written a blog post to invite users to stop using Viber until the company will fix these private issues.

The experts have ethically reported the flaw to Viber security team, in time I’m writing they still haven’t received any response.

Let’s see what happen … meantime, put your privacy at first place!