Just one picture would have used to take over WhatsApp and Telegram accounts

A single picture could have been used by attackers to hack the popular secure messaging applications WhatsApp and Telegram.

Security experts from Checkpoint have discovered a vulnerability that was present in both messaging services. The hack only affected the browser-based versions of both WhatsApp and Telegram.

The flaw affected the way both apps process images and multimedia files, in both cases they lack verifying the presence of malicious code inside the media files.

This flaw, if exploited, would have allowed hackers to take over victims’accounts on any browser. The attackers would have exploited the issue to access victims’ personal and group conversations, videos, photos, and other shared files, contact lists, and much more.

The attack starts by sending an image containing a hidden malicious code, the flaw is triggered when the victim clicks on the picture.

“The exploitation of this vulnerability starts with the attacker sending an innocent looking file to the victim, which contains malicious code.” reads the blog post published by security firm CheckPoint. “In WhatsApp, once the user clicks to open the image, the malicious file allows the attacker to access the local storage, where user data is stored. In Telegram, the user should click again to open a new tab, in order for the attacker to access local storage. From that point, the attacker can gain full access to the user’s account and account data. The attacker can then send the malicious file to the all victim’s contacts, opening a dangerous door to a potentially widespread attack over the WhatsApp and Telegram networks.”

Below the video PoC of the attacks on both Telegram and WhatsApp:

The vulnerability in both messaging apps was difficult to discover because they implement end-to-end encryption for their messages, this means that the companies offering the services were not able to analyze the malicious image used to trigger the issue.

“Since messages were encrypted without being validated first, WhatsApp and Telegram were blind to the content, thus making them unable to prevent malicious content from being sent.” continues the analysis.

“Check Point disclosed this information to WhatsApp’s and Telegram’s security teams on March 7th. Both companies have verified and acknowledged the security issue and developed a fix for web clients worldwide soon after.”

Both companies quickly fixed the issue, WhatsApp has done it in just 24 hours.

WhatsApp confirmed that the vulnerability was not exploited by attackers in the wild.

The fix applied by the companies is simple, both messaging apps now validate the media files before sending it in encrypted format.

[adrotate banner=”9″]

Pierluigi Paganini

(Security Affairs – Telegram, WhatsApp)

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.