Flaw in WhatsApp and Signal exposes group chats to 'extremely difficult' hacks

WhatsApp

"WhatsApp is built so group messages can not be send to hidden users and provides multiple ways for users to confirm who receives a message prior to it being sent".

"The confidentiality of the group is broken as soon as the uninvited member can obtain all the new messages and read them", said Paul Rösler, one of the Ruhr University researchers speaking to Wired.

FACEBOOK-OWNED WhatsApp suffers from a flaw that makes it possible for anyone to infiltrate private group chats without admin permission. Usually, only admins can add the new members to private groups. A research paper released at a security event this week describes how group chats can be leveraged by snoops.

Security researchers have revealed details of a vulnerability in WhatsApp's security that could be used to compromise the secrecy of encrypted group chats on the messaging platform.

At the moment WhatsApp servers can only be accessed by its employees and governments who follow the legal route to gain access through court orders.

With over 1.2 billion monthly active users, WhatsApp is available in more than 50 different languages around the world and in 10 Indian languages.

For the Signal messaging app, which uses the same underlying encryption protocol as WhatsApp, the security researchers found the app contains the same group chat vulnerability but further mitigated by an attacker not only having to control the relevant Signal server but also having to know the Group ID number for the chat (and these IDs are essentially unguessable). "Existing members are notified when new people are added to a WhatsApp group".

On the surface level, WhatsApp, which is owned by Facebook, looks to have a pretty big security flaw.

Once an attacker with access to a WhatsApp server had added a new member to a group the phone of every participant would automatically share secret keys with that new member - affording them full access to any future messages.

Despite WhatsApp's secure end-to-end encryption for messages, German researchers have found a loophole that could allow hackers to worm their way into WhatsApp's group chats.

WhatsApp confirmed these finding to Wired, though it said every time a new unknown member is added, the app has a notification alert go out. However, this is a security hole that can not be excused, claims the report.

Researchers advise messaging services to address the issue by simply adding an authentication mechanism to ensure that the "signed" group management messages come only from the group administrator.

Moxie also took a potshot at the researchers saying that - "This article reads as a better example of the problems with the security industry and the way security research is done today, because I think the lesson to anyone watching is clear: don't build security into your products, because that makes you a target for researchers, even if you make the right decisions, and regardless of whether their research is practically important or not".

Related News:

  • 'Darkest Dungeon' Comes To Nintendo Switch On January 18

    If you haven't played Darkest Dungeon yet, or even if you have, the Nintendo Switch seems like a flawless fit for it. Congrats to the team on the announcement - we're looking forward to diving back into these dungeons!
    James Rosen left Fox News amid reports he sexually harassed colleagues

    James Rosen left Fox News amid reports he sexually harassed colleagues

    Just last month, Fox's owner, Rupert Murdoch, told Sky News that there had been no further allegations at the company after Mr. Fox News fired two other employees, host Eric Bolling and executive Francisco Cortes , following misconduct accusations.
    Single-famly homes down a bit in price: Royal LePage

    Single-famly homes down a bit in price: Royal LePage

    Agent Steve Saretsky says buyers spent almost double on Surrey condos in 2017 over the previous year. Meanwhile single family home prices across the region climbed by about 12 per cent to $1.5 million.
  • Analyst Earnings Forecast Scan: Norwegian Cruise Line Holdings Ltd. (NCLH)

    Analyst Earnings Forecast Scan: Norwegian Cruise Line Holdings Ltd. (NCLH)

    Finally, Ameritas Investment Partners Inc. grew its holdings in shares of Norwegian Cruise Line by 1.9% during the second quarter. Star NCLC Holdings Ltd . also sold $409.28M worth of Norwegian Cruise Line Holdings Ltd. (NYSE:NCLH) on Wednesday, August 16.
    Sales rise for food wholesaler Booker

    Sales rise for food wholesaler Booker

    In the core United Kingdom market, Tesco's like-for-like sales increased by 1.9% during the Christmas period, the company said. However, it did not give a breakdown of like-for-like sales, again ignoring an industry benchmark used by its peers.
    Aussie actor Craig McLachlan denies sexual misconduct claims

    Aussie actor Craig McLachlan denies sexual misconduct claims

    Rennie's appointment follows an apology by producer John Frost, Managing Director of The Gordon Frost Organisation, yesterday. Whelan Browne says McLachlan touched and kissed her inappropriately during a performance of The Rocky Horror Show in 2014.
  • Adam Rippon Makes History; Becomes First Openly Gay US Olympic Skater

    Adam Rippon Makes History; Becomes First Openly Gay US Olympic Skater

    Figure Skating in a promotional video. "I am so excited to be on this Olympic team", Rippon said in a statement to The Advocate . Weir competed at the games in 2006 and 2010, and came out in his book Welcome to My World in 2011 .
    Gillian Anderson confirms she's leaving 'The X-Files'

    Gillian Anderson confirms she's leaving 'The X-Files'

    That answer certainly makes sense when seeing how she has continued to take on new roles over the years. The announcement comes just days after Anderson received her star on the Hollywood Walk of Fame.
    Giant recalls orange cream bars, ice cream bars

    Giant recalls orange cream bars, ice cream bars

    In addition customers may call Giant Food Customer Service at 1-888-469-4426 for more information or visit the Giant website . Consumers looking for additional information on the recall may call Fieldbrook Foods at 1-800-333-0805 x2270.
  • Golden Globes bring scant focus to wide-open Oscar race

    Golden Globes bring scant focus to wide-open Oscar race

    When accepting her award, Nicole said it went to the power of women including her good friend and co-star Reese Witherspoon . It was a series about a group of women realizing they're far more powerful as a group than they are as rivals.
    Princess Charlotte has a hidden talent already!

    Princess Charlotte has a hidden talent already!

    As Princess Charlotte begins nursery school this week, People got the first insight on the two-year-old's character and talents. In photos released by Kensington Palace on Monday, the 2-year-old definitely doesn't seem to have any first-day jitters.
    Fritz Pollard Alliance questions whether Raiders violated Rooney Rule

    Fritz Pollard Alliance questions whether Raiders violated Rooney Rule

    Davis has long pursued Gruden to be Oakland's head coach, and the Raiders officially announced his hiring on January 6. Gannon played three seasons (1999-2001) for Gruden during the coach's first stint with the Raiders.


Most liked

Dish Adds Google Assistant To Set-Top Boxes
It will work with all generations of Dish's Hopper DVR , all models of its Joey client, and its Wally single-tuner HD receiver. Dish today announced that it's going to bring Google Assistant to its set-top boxes in the coming months.

Trevor Noah explains why Oprah is the best opponent for Trump
And if the Golden Globes are any predictor of what will happen in the next two years, expect to get real exhausted real fast by talk of President Oprah .

Joe Arpaio points to political traits he shares with Trump
If I did, I wouldn't know what office to run for", said Arpaio about his response he gave at the time of the question. He also said the president had not asked him to run for the Senate. "I'm not going to go into all the details".

Prepaid Plans Now Give More Data And Longer Validity
This is one of the best implementation from Airtel this year, and this move will undoubtedly match it up with Reliance Jio . However, Jio's initial price advantage was challenged by incumbent competitors like Airtel , which matched its offers.

Report Of Shots Fired Near CSUSB Campus
The university sent out a tweet notifying students that shots had been fired near the Visual Arts Building and parking structure. Classrooms at the Cal State University San Bernardino are on lockdown following reports of a shooting in the campus.

Will Bettors Cash Over in Blazers vs. Rockets Game? NBA Predictions 1/10/18
The Rockets narrowly defeated the Blazers 124-117 back on December 9, after trailing by 14 at the start of the fourth quarter. Already up seven points with the clock winding down, Paul drove through the lane and made a layup.

US Federal Energy Regulator rejected to subsidize coal and nuclear power plants
The commission issued an order initiating a new proceeding "to holistically examine the resilience of the bulk power system". Powelson, Richard Glick and Cheryl A.

Another major security flaw found in macOS High Sierra
Thankfully Apple was quick in issuing an update that fixed the problem, but now it appears that a new password bug has appeared. The login prompt simply accepts the incorrect password and unlocks , as long as you are still logged in as a local admin.

State senator denies allegations of forcibly kissing staffer
Krueger said she did not initially ask which senator was involved, to avoid any potential bias, she said she immediately found Ms. Vladimer was looking for "a way to help other young women know that they could say no and not feel shame".

Woman found dead in abandoned Subway identified as GSU student
A missing woman was found dead in a Georgia mall where she had been decomposing for about two weeks, authorities said. The Medical Examiner's Officer has not ruled the case as a homicide as details are still being investigated.

Coli outbreak linked to romaine lettuce appears to be over, agency says
The CDC believes the USA and Canadian cases could be related, but isn't ready to issue a a specific warning about romaine. You can also wash counters, cutting boards, and utensils after they touch raw meat to avoid contaminating other foods.

North Royalton hacker stole potentially embarrassing information from computers, feds say
According to prosecutors, from 2003 to early 2017, Durachinsky infected thousands of computers. Officials said some of the computers infected by Fruitfly went beyond personal computers.

Raptors' Serge Ibaka, Heat's James Johnson suspended one game for throwing punches
And with the NBA's best winning percentage - a 33-8 record heading into Wednesday night's game against the L.A. The discipline marks the second time in less than a month that Ibaka has been suspended.

Sears raises $100M in new financing, eyes $200M in cost cuts
ValuEngine upgraded Sears from a "strong sell" rating to a "sell" rating in a research report on Friday, December 1st. The company reported ($2.64) earnings per share for the quarter, beating the consensus estimate of ($4.46) by $1.82.

Coyotes trade Anthony Duclair to Blackhawks for Richard Panik
As recently as last week Duclair informed the Arizona Coyotes that he wanted out and the Blackhawks were the ideal fit. If nothing else he is going to get an opportunity to play with significantly more talent surrounding him.