WhatsApp Security Flaw Could Allow Impostors To Enter Group Conversations

WhatsApp Security Flaw Could Allow Impostors To Enter Group Conversations

The app doesn't use an authentication mechanism for inviting new members to a group chat, which means that its servers can spoof said invitation.

The researchers from Ruhr University Bochum in Germany announced this big news at the "Real World Crypto Security Conference" which was held in Zurich, Switzerland, on January 10. "But there is no [sic] a secret way into WhatsApp groups chats". According to the paper, investigation into "end-to-end protected group communications" has gained only little attention. "We built WhatsApp so group messages can not be sent to a hidden user".

WhatsApp is likely to give group administrators more powers where they will be able to restrict all other members from sending text messages, photographs, videos, GIFs, documents or voice messages in case the admin thinks so.

Moxie Marlinspike, a security researcher who developed Signal, which licenses its protocol to WhatsApp, said that the current app design is reasonable, and that the report only sends a message to others not to "build security into your products, because that makes you a target for researchers, even if you make the right decisions". According to the German researchers, the power of any WhatsApp group lies in WhatsApp servers and not the group admin.

Lenovo Mirage Solo is the World's First Standalone Daydream VR Headset
It will sell for $449, and is expected to ship in the second quarter of 2018, alongside Lenovo's Mirage VR streaming camera. This would be good if you are wanting to get some great immersive images that you want to share in virtual reality later on.

Firstly, control of WhatsApp servers tends to be only possible by Facebook (which owns WhatsApp), and governments who can demand access to the servers. We built WhatsApp so group messages can not be sent to a hidden user.

In short, anyone who has control of a WhatsApp server could effortlessly insert new people into a private group. Once an attacker with server control accessed the conversation, he or she could also use it to selectively block any messages in the group, including those that ask questions, or provide warnings about the new entrant.

Facebook's Chief Security Officer Alex Stamos responded to the report on Twitter, saying, "Read the Wired article today about WhatsApp - scary headline!"

"Existing members are notified when new people are added to a WhatsApp group", the platform said. In such a case, it is impossible for them to share details with enforcement agencies that they themselves can not access. The fear for some people is that this security flaw will result in WhatsApp being coerced by government agencies into allowing the flaw to be exploited to eavesdrop on conversations. The attacker will not see any past messages to the group; those were e2e encrypted with keys the attacker doesn't have. 2. The membership of a group can be seen by tapping on "group info". "An attacker who compromises the Telegram server can, undetected, recover every message that was sent in the past and receive all messages transmitted in the future without anyone receiving any notification at all". "There is no way to suppress this message", he wrote.

Related Articles

  • GoPro expects revenue slump, slashes workforce

    GoPro expects revenue slump, slashes workforce

    GoPro Chief Executive Officer Nick Woodman became the best-compensated USA executive for 2014, when his company went public. While the company states although the Karma Drone saw success, there were multiple factors that lead to the final decision.
    President Trump gets national anthem moment at football title game

    President Trump gets national anthem moment at football title game

    When the President was arriving in his motorcade, football fans who had been waiting outside the stadium had a mixed reaction. Thankfully, protesters were able to get their message across without being threatened by pro-Trump supporters.
    First Alexa-enabled digital glasses to debut at CES

    First Alexa-enabled digital glasses to debut at CES

    While it is a high price point, "the ultimate goal is to have it under US$500 and we'll be able to do that" by next year, he said. Vuzix unveiled at CES a new pair of smart glasses to deliver augmented reality content from connected smartphones and computers.
  • Martin Guptill returns to form to beat rain and Pakistan

    Martin Guptill returns to form to beat rain and Pakistan

    Martin Guptill and Colin Munro established an 83-run opening partnership for New Zealand before Hasan Ali picked Munro's wicket. Williamson and Guptill restored some order, before a superb diving catch at point from Shadab left New Zealand at 47 for 2.
    Acer Unveil Chromebook 11 With Fanless Design

    Acer Unveil Chromebook 11 With Fanless Design

    The Acer Chromebook 11 comes with two USB 3.0 ports, and this time, two USB Type-C ports are included as well. Having the model number CB311, this new Chromebook is said to come with no compromises to the battery life .
    Panthers part ways with Mike Shula and Ken Dorsey

    Panthers part ways with Mike Shula and Ken Dorsey

    However, he and Dorsey were unable to get that type of consistent production out of Newton and the passing game. Carolina went 11-5 during the regular season, but lost 31-26 to the Saints on Sunday in the wild-card round.
  • Sony Xperia XA2, Xperia XA2 Ultra selfie smartphones launched at CES 2018

    Sony Xperia XA2, Xperia XA2 Ultra selfie smartphones launched at CES 2018

    The new handsets aren't flagship devices, but rather mid-range phones that Sony has dubbed "super mid-tier smartphones". Both of these new Sony devices boast a stunning edge-to-edge display, meaning they're pleasingly thin when grasped.
    Liverpool reportedly unlikely to pursue top target

    Liverpool reportedly unlikely to pursue top target

    Klopp said: "We have never been in a better position in recent times, as a club, to react in the right way". Jardim has claimed that many things could happen in January and has kept the door open for Lemar sale.
    Shape of Water leads BAFTA nominations

    Shape of Water leads BAFTA nominations

    Darkest Hour also received nominations for best film and for Kristin Scott Thomas in the supporting-actress category. The awards will take place at the Royal Albert Hall in London on February 18.
  • Fired engineer James Damore sues Google for discriminating against conservative white males

    Fired engineer James Damore sues Google for discriminating against conservative white males

    James Damore was sacked by Google after he issued a manifesto in which he stated that women were biologically inferior engineers. His claims: that Google unfairly discriminates against white men whose political views are unpopular with its executives.
    Teacher Arrested For Asking Why Superintendent Got A Raise

    Teacher Arrested For Asking Why Superintendent Got A Raise

    The Vermillion Parish schools referred questions to Fontana, who did not immediately respond to Fox News' request for comment. It remains unclear whether the marshal was acting on his own accord or on orders of the board members, according to KATC.
    Meghan Markle closes social media accounts after engagement to Prince Harry

    Meghan Markle closes social media accounts after engagement to Prince Harry

    Markle is grateful to everyone who has followed her social media accounts over the years", the palace statement said. Instead, updates about their lives and careers are posted on one set of accounts, run by Kensington Palace.