A recent finding by Check Point Software Technologies Ltd. throws light on how susceptible messaging apps are to hacking and data theft. The discovery by Check Point, mentioning especially Whatsapp and Telegram, which contain a critical security flaw in their end-to-end message encryption process. This makes both their online platforms – WhatsApp Web and Telegram Web – vulnerable to outside access.
To make their point clear, Check Point designed a malicious, innocuous file to take full control over Whatsapp and Telegram user accounts. In order to gain access, all an attacker would have to do is fake a MIME type, by crafting the HTML file to display an image preview. Once the victim clicks on the HTML file, the attacker would gain access, and the victim’s account would be taken over by the attacker completely.
The alarming case-in-point here is that while most such attacks over either Whatsapp or Telegram will give attackers access to only tidbits of the users’ data, there is also the possibility for attackers to gain absolute control over the victim’s account.
Once a hacker has full control of the victim’s account, he/she will be able to download the victim’s previously shared photos, videos, contact information, and will also have access to the victim’s friends’ information. This means attackers would be able to post the victim’s photos online, message on the victim’s behalf, and would even be able to take over the victim’s friends’ accounts.
Concerns regarding user privacy over messaging apps was brought to the fore by the recent WikiLeaks publication, which talked about the possibility for government organisations to access Whatsapp, Telegram, or any other end-to-end encrypted chat app. Encryption is primarily designed to ensure that only the people communicating can read the messages. But since over Whatsapp and Telegram, messages are encrypted even before they were validated, it was easy for both chat applications to turn a blind eye towards the issue. The encryption had essentially made them unable to prevent any malicious content from being sent.
After Check Point having disclosed their alarming findings to both companies’ security teams, the security teams have acknowledged that there are security and data threat issues. Both companies have now developed a fix for their web clients. Both Whatsapp and Telegram are now validating content over their platforms before the encryption process itself, allowing them to block out any seemingly malicious files. It would, however, be safer to err on the side of caution as a user and avoid downloading any content and opening any links sent by unknown users. Additionally, periodically cleaning logged-in computers from the Whatsapp and Telegram log will allow you more control over the devices that have the option to host your account.
Meanwhile, cyber-security continues to remain an issue garnering growing concern and attention. The increasing number of internet-connected devices around us allows hackers to employ a broad range of tactics to pry into hapless victims’ lives. Further, the sheer large amount of data of personal/private/confidential nature that is exchanged over networks brings with it the risks of data leakage, data theft, and cyber attack by hackers.
Interestingly, Telegram, which accounted for about 87% of downloads worldwide in 2016, not only makes it the most downloaded messaging app in 2016, but is also what users considered the most secure. Even though Whatsapp also uses an end-to-end message encryption technology, users seem sceptical about the amount of security the app can really offer.
As of January 2017, however, Whatsapp, with over 1.2 billion monthly active users is the still most popular mobile messaging app, followed very closely by Facebook messenger. Telegram, with just about 100 million monthly active users is slowly gaining popularity and catching up with Whatsapp, thanks to the amount of security it provides.
With about $5.75 billion being the estimated size of the global mobile security market in 2019, one can only imagine the proportionate growth in security breaches and data thefts over the next three years. Let’s not forget the growing security concerns for mobile applications in general, and specifically to Instant messaging applications.
Figure 12-6: An ever-growing list of known buffer overflow vulnerabilities.
