Check Point Discloses How Hackers Can Take Over Hundreds of Millions of Whatsapp & Telegram Accounts in Seconds

15 March 2017
Content from a Premium Partner
African Media Agency (New York)
press release

NAIROBI, Kenya, March 15, 2017 -/African Media Agency (AMA)/ — New Vulnerability revealed in popular messaging services, WhatsApp and Telegram, allowed hackers to gain complete control over accounts, including chats, images, video and audio files, and contacts

Check Point® Software Technologies Ltd. (NASDAQ: CHKP) researchers today revealed a new vulnerability on WhatsApp & Telegram's online platforms - WhatsApp Web & Telegram Web - two of the world's most popular messaging services. By exploiting this vulnerability, attackers could completely take over user accounts, and access victims' personal and group conversations, photos, videos and other shared files, contact lists, and more.

"This new vulnerability put hundreds of millions of WhatsApp Web and Telegram Web users at risk of complete account take over," says Doros Hadjizenonos, Country Manager of Check Point South Africa. "By simply sending an innocent looking photo, an attacker could gain control over the account, access message history, all photos that were ever shared, and send messages on behalf of the user."

The vulnerability allows an attacker to send the victim malicious code, hidden within an innocent looking image. As soon as the user clicks on the image, the attacker can gain full access to the victim's WhatsApp or Telegram storage data, thus giving full access to the victim's account. The attacker can then send the malicious file to all the victim's contacts, potentially enabling a widespread attack.

Check Point disclosed this information to the WhatsApp and Telegram security teams on March 8, 2017. WhatsApp and Telegram acknowledged the security issue and developed fixes for worldwide web clients. "Thankfully, WhatsApp and Telegram responded quickly and responsibly to deploy the mitigation against exploitation of this issue in all web clients," said Hadjizenonos. WhatsApp and Telegram web users wishing to ensure that they are using the latest version are advised to restart their browser.

WhatsApp and Telegram use end-to-end message encryption as a data security measure, to ensure that only the people communicating can read the messages, and nobody in between. Yet, the same end-to-end encryption was also the source of this vulnerability. Since messages were encrypted on the side of the sender, WhatsApp and Telegram were blind to the content, and were therefore unable to prevent malicious content from being sent. After fixing this vulnerability, content will now be validated before the encryption, allowing malicious files to be blocked.

Both web versions mirror all messages sent and received by the user on the mobile app, and are fully synced with users' devices

WhatsApp has over 1 billion users worldwide, making it the most prevalent instant messaging service available today. The company's web version is available on all browsers and WhatsApp supported platforms, including Android, iPhone (iOS), Windows Phone 8.x, BlackBerry, BB10 and Nokia smartphones.

Telegram is a cloud-based mobile and desktop messaging app that has over 100 million monthly active users, delivering over 15 billion messages daily.

For technical details you can check the Check Point blog: http://blog.checkpoint.com/2017/03/15/check-point-discloses-vulnerability-whatsapp-telegram/

Demo videos can be found here:

* WhatsApp: https://youtu.be/UR_i5XSAKrg

* Telegram: https://youtu.be/26Ih4xTcP-E

Distributed by African media Agency on behalf of Check Point Software Technologies

Follow Check Point via:

Twitter: http://www.twitter.com/checkpointsw

Facebook: https://www.facebook.com/checkpointsoftware

Blog: http://blog.checkpoint.com

YouTube: http://www.youtube.com/user/CPGlobal

LinkedIn: https://www.linkedin.com/company/check-point-software-technologies

About Check Point Software Technologies Ltd.

Check Point Software Technologies Ltd. (www.checkpoint.com) is the largest network cyber security vendor globally, providing industry-leading solutions and protecting customers from cyber attacks with an unmatched catch rate of malware and other types of threats. Check Point offers a complete security architecture defending enterprises - from networks to mobile devices - in addition to the most comprehensive and intuitive security management. Check Point protects over 100,000 organisations of all sizes.

Source: Check Point Software Technologies

Read the original article on AMA.

Tagged:
Copyright © 2017 African Media Agency. All rights reserved. Distributed by AllAfrica Global Media (allAfrica.com). To contact the copyright holder directly for corrections — or for permission to republish or make other authorized use of this material, click here.

AllAfrica publishes around 400 reports a day from more than 100 news organizations and over 500 other institutions and individuals, representing a diversity of positions on every topic. We publish news and views ranging from vigorous opponents of governments to government publications and spokespersons. Publishers named above each report are responsible for their own content, which AllAfrica does not have the legal right to edit or correct.

Articles and commentaries that identify allAfrica.com as the publisher are produced or commissioned by AllAfrica. To address comments or complaints, please Contact us.