WhatsApp is a popular and easy to use messaging program. It has some security features, like the use of end-to-end encryption to keep messages private. However, hacks targeting WhatsApp could compromise the privacy of your messages and contacts.
Here are eight ways that WhatsApp can be hacked.
1. Remote Code Execution via GIF
In October 2019, security researcher Awakened revealed a vulnerability in WhatsApp that let hackers take control of the app using a GIF image. The hack works by taking advantage of the way that WhatsApp processes images when the user opens the Gallery view to send a media file.
When this happens, the app parses the GIF to show a preview of the file. GIF files are special because they have multiple encoded frames. This means that code can be hidden within the image.
If a hacker were to send a malicious GIF to a user, they could compromise the user’s entire chat history. The hackers would be able to see who the user had been messaging and what they had been saying. They could also see users’ files, photos, and videos sent through WhatsApp.
The vulnerability affected versions of WhatsApp up to 2.19.230 on Android 8.1 and 9. Fortunately, Awakened disclosed the vulnerability responsibly and Facebook, which owns WhatsApp, patched the issue. To keep yourself safe from this problem, you should update WhatsApp to version 2.19.244 or above.
2. The Pegasus Voice Call Attack
Another WhatsApp vulnerability discovered in early 2019 was the Pegasus voice call hack.
This scary attack allowed hackers to access a device simply by placing a WhatsApp voice call to their target. Even if the target didn’t answer the call, the attack could still be effective. And the target may not even be aware that malware has been installed on their device.
This worked through a method known as buffer overflow. This is where an attack deliberately puts too much code into a small buffer so that it “overflows” and writes code into a location it shouldn’t be able to access. When the hacker can run code in a location that should be secure, they can take malicious steps.
This attack installed an older and well-known piece of spyware called Pegasus. This allowed hackers to collect data on phone calls, messages, photos, and video. It even let them activate devices’ cameras and microphones to take recordings.
This vulnerability applied to Android, iOS, Windows 10 Mobile, and Tizen devices. It was used by the Israeli firm NSO Group which has been accused of spying on Amnesty International staff and other human rights activists. After news of the hack broke, WhatsApp was updated to protect it from this attack.
If you are running WhatsApp version 2.19.134 or earlier on Android or version 2.19.51 or earlier on iOS, then you need to update your app immediately.
3. Socially Engineered Attacks
Another way that WhatsApp is vulnerable is through socially engineered attacks. These exploit human psychology to steal information or spread misinformation.
A security firm called Check Point Research revealed one such attack they named FakesApp. This allowed people to misuse the quote feature in group chat and to alter the text of another person’s reply. Essentially, hackers could plant fake statements that appear to be from other legitimate users.
The researchers could do this by decrypting WhatsApp communications. This allowed them to see data sent between the mobile version and the web version of WhatsApp.
And from here, they could change values in group chats. Then they could impersonate other people, sending messages which appeared to be from them. They could also change the text of replies.
This could be used in worrying ways to spread scams or fake news. Even though the vulnerability was disclosed in 2018, it had still not been patched by the time the researchers spoke at the Black Hat conference in Las Vegas in 2019, according to ZNet.
Media File Jacking affects both WhatsApp and Telegram. This attack takes advantage of the way that apps receive media files like photos or videos and write those files to a device’s external storage.
The attack starts by installing malware hidden inside an apparently harmless app. This can then monitor incoming files for Telegram or WhatsApp. When a new file comes in, the malware can swap out the real file for a fake one. Symantec, the company that discovered the issue, suggests it could be used to scam people or to spread fake news.
There is a quick fix for this issue. In WhatsApp, you should look in Settings and go to Chat Settings. Then find the Save to Gallery option and make sure it is set to Off. This will protect you from this vulnerability. However, a true fix for the issue will require app developers to entirely change the way that apps handle media files in the future.
5. Facebook Could Spy on WhatsApp Chats
In a blog post, WhatsApp implied that because it uses end-to-end encryption, it is impossible for Facebook to read WhatsApp content:
“When you and the people you message are using the latest version of WhatsApp, your messages are encrypted by default, which means you’re the only people who can read them. Even as we coordinate more with Facebook in the months ahead, your encrypted messages stay private and no one else can read them. Not WhatsApp, not Facebook, nor anyone else.”
However, according to developer Gregorio Zanon, this is not strictly true. The fact WhatsApp uses end-to-end encryption does not mean all messages are private. On an operating system like iOS 8 and above, apps can access files in a “shared container.”
Both the Facebook and WhatsApp apps use the same shared container on devices. And while chats are encrypted when they are sent, they are not necessarily encrypted on the originating device. This means the Facebook app could potentially copy information from the WhatsApp app.
To be clear, there is no evidence that Facebook has used shared containers to view private WhatsApp messages. But the potential is there for them to do so. Even with end-to-end encryption, your messages may not be private from Facebook’s all-seeing eye.
6. Paid Third-Party Apps
You’d be surprised how many paid legal apps have sprung up in the market that solely exist for hacking into secure systems.
This could be done by big corporations working hand-in-hand with oppressive regimes to target activists and journalists; or by cybercriminals, intent on getting your personal information.
Apps like Spyzie and mSPY can easily hack into your WhatsApp account for your stealing your private data.
All you need to do is purchase the app, install it, and activate it on the target phone. Finally, you can sit back and connect to your app dashboard from the web browser, and snoop in on private WhatsApp data like messages, contacts, status, etc. But obviously we advise against anyone actually doing this!
7. Fake WhatsApp Clones
Using fake websites clones for installing malware is an old hacking strategy still implemented by many hackers all over the world. These clone sites are known as malicious websites.
The hacking tactic has now also been adopted for breaking into Android systems. To hack into your WhatsApp account, an attacker will first try to install a clone of WhatsApp, which might look strikingly similar to the original app.
Take the case of the WhatsApp Pink scam, for instance. A clone of the original WhatsApp, it claims to change the standard green WhatsApp background to pink. Here’s how it works.
An unsuspecting user receives a link to download the WhatsApp Pink app for changing the background color of their app. And even though it really does change the background color of your app to pink, as soon as you install the app, it will start collecting data not just from your WhatsApp but also from everything else stored on your phone.
8. WhatsApp Web
WhatsApp Web is a neat tool for someone who spends most of their day on a computer. It provides the ease of accessibility to such WhatsApp users, as they won’t have to pick up their phone again and again for messaging. The big screen and keyboard provides an overall better user experience too.
Here’s the caveat, though. As handy as the web version is, it can be easily used to hack into your WhatsApp chats. This danger arises when you’re using the WhatsApp Web on someone else’s computer.
So, if the owner of the computer has selected the keep me signed in box during login, then your WhatsApp account will stay signed-in even after you close the browser.
The computer owner can then access your information without much difficulty.
You can avoid this by making sure that you log out from WhatsApp Web before you leave. But as they say, prevention is better than cure. The best approach is to avoid using anything other than your personal computer for the web version of WhatsApp altogether.
Stay Aware of Security Issues in WhatsApp
To learn more about whether WhatsApp is safe, you need to brush up your knowledge of WhatsApp security threats.
These are just a few examples of how WhatsApp can be hacked. While some of these issues have been patched since their disclosure, others have not, so it’s important to stay vigilant.
About The Author
