WhatsApp flaw might let joining group chats without permission

Creepy hackers could secretly eavesdrop on your private WhatsApp group chats, experts claim

Here's how WhatsApp group messaging works: membership is maintained by the server.

Reacting to the report, Facebook Chief Security Officer Alex Stamos tweeted: "Read the Wired article about WhatsApp - scary headline!"

While, the group and the chats themselves have a layer of end-to-end encryption, the servers that the chats run on don't.

In response to the study, Facebook, which owns WhatsApp, has said it won't fix the problem, and that group chats "remain protected" by the app's encryption.

So far, we have been led to believe that end-to-end encryption in mobile phones and messaging apps like iMessage, WhatsApp and Telegram ensures that messages sent and received by users are so well scrambled that the services themselves can not access or read them.

But, as it turns out, the Signal protocol does not check whether the message was sent by an actual member of the group, meaning that anyone outside the group can send the message and, consequently, add a new user to the group. Given that the security and privacy of the users is a priority for WhatsApp, they collect very little information and all the messages are end-to-end encrypted.

Computer researchers have discovered a set of flaws in WhatsApp that could allow uninvited individulals into private group chats.

While gaining access to WhatsApp servers are limited to the abilities of advanced hackers, the question is what happens when they gain access?

According to the team, anyone with access to WhatsApp's servers could easily insert new people into a private group without needing the permission of the administrator. With over 1.2 billion monthly active users, WhatsApp is available in more than 50 different languages around the world and in 10 Indian languages.

"WhatsApp has looked at the report carefully - following the researcher's plan would necessitate a change to the way WhatsApp provides a popular feature called group invite links - which are used millions of times per day", he said in one of the tweets. In such a case, it is impossible for them to share details with enforcement agencies that they themselves can not access. Additionally, shared messages can be encrypted too.

'We built WhatsApp so group messages can not be sent to a hidden user. One example attack posited that former members of groups could record the group ID and use that for future attacks. "There is no way to suppress this message", he wrote.

The idea of creating a backdoor itself is absurd, considering how a small hack that allows authorities to bypass end-to-end encryption can be exploited or abused by cyber criminals and enemy states as well, thereby compromising the privacy of every single individual using a particular messaging service. The attackers might send spoofed messages in order to prevent the administrator from removing spy from the private conversation.

Related news:

Hot News

isis-killer-beheading-video-story-top Super Mario Odyssey to get free 'Luigi's Balloon World' add-on
Jan 12, 2018 - 03:28
The new content will include a minigame-Luigi's Balloon World-hosted by Luigi, as well as new costumes and photo filters. Here are the Sunshine Shades and Sunshine Outfit, the Musician Hat and Musician Outfit, and the Knight Helmet and Armor.

isis-killer-beheading-video-story-top House urged to cancel vote on NSA spying after Trump tweets
Jan 12, 2018 - 03:28
Critics contend that the extension will be used by government agencies to spy on Americans without warrants. The so-called 702 authority was put in place after the 9/11 attacks.

isis-killer-beheading-video-story-top Andover Health Division encourages residents to get vaccinated as flu cases spike
Jan 12, 2018 - 03:28
People in close contact with high-risk groups, should get a flu shot to protect themselves and the people in their care. Forty-six states have seen widespread flu , and 13 children have died from complications of the virus since October.

isis-killer-beheading-video-story-top Dark Souls Remastered Coming May 25
Jan 12, 2018 - 03:18
The remastered edition of the game features a graphical overhaul and will render at a higher resolution. It will be the first Mario Tennis title since the Game Boy Advance iteration to include a story mode.

isis-killer-beheading-video-story-top HP recalls batteries that may overheat, leading to fires
Jan 11, 2018 - 08:15
The company has released a statement about the issue that says, "The quality and safety of all HP products is our top priority". It seems the company has learned its lesson since the much-reported case in 2011 in which HP recalled 162,000 battery units.

isis-killer-beheading-video-story-top Android Pay and Google Wallet fall under new Google Pay moniker
Jan 11, 2018 - 08:06
Android Pay is now Google's primary payment brand, but it's a bit awkward given it is branded as a platform-specific thing. All said and done, digital payment efforts by either Google or Apple in India didn't seem to have taken off as expected.

isis-killer-beheading-video-story-top Yankees not out of the Gerrit Cole hunt yet
Jan 11, 2018 - 06:10
His home-run rate spiked dramatically to 1.4 per nine after allowing 0.6 per nine for the first four years of his career. Now, according to multiple reports, the Astros are on the verge of landing Pittsburgh Pirates ace Gerrit Cole .

isis-killer-beheading-video-story-top Cleveland Browns poach Packers personnel exec Eliot Wolf
Jan 11, 2018 - 01:03
Owner Jimmy Haslam will surely be hoping Dorsey and Wolf can lead the Browns back to respectability with haste. Dorsey and Wolf, son of former Packers General Manager Ron Wolf, worked together for nine years in Green Bay.

isis-killer-beheading-video-story-top Matt Patricia destined to be New York Giants head coach?
Jan 11, 2018 - 01:01
According to Peter King , Patricia actually favors the head coaching vacancy for the New York Giants over the Lions. The Giants cannot officially come to terms on a contract with Patricia until New England's season comes to an end.

isis-killer-beheading-video-story-top Rain and snow in the forecast
Jan 10, 2018 - 01:43
A better chance for rain will develop for Friday , with rain transitioning to a wintry mix Friday night and to snow for Saturday . Friday , freezing rain before 7 a.m., then sleet likely between 7 a.m. and 8 a.m., then snow showers likely after 8 a.m.

isis-killer-beheading-video-story-top Steyer Hedges on Democrats
Jan 10, 2018 - 01:42
In 2016, the group focused on mobilizing young voters around climate change policies. Rumors had swirled around whether he would challenge Sen.

isis-killer-beheading-video-story-top Kia Niro EV: Is It More Techy Than Motory?
Jan 10, 2018 - 01:35
Interestingly, Kia says the concept "draws inspiration from" the existing Niro, though it looks pretty close indeed to us. Following in the footsteps of other automakers, Kia is getting serious about highly automated vehicles early next decade.

isis-killer-beheading-video-story-top Resident trying to kill spider causes apartment fire in Redding
Jan 10, 2018 - 01:35
Fire officials say they found a fire extinguisher and hose at the scene, showing the residents attempted to extinguish the fire. Lyndsey Wisegarver, who is the care giver for one of the men who lives in the building, said it was a "huge wolf spider ".

isis-killer-beheading-video-story-top Overwatch Update Adds League Skins
Jan 10, 2018 - 01:34
To actually purchase an Overwatch League skin just select on the team of your choice to bring up the character roster. You can also view what their weapon looks like in the various team colors by selecting the icon right below the hero.

isis-killer-beheading-video-story-top Teacher handcuffed by officer at school board meeting
Jan 10, 2018 - 01:30
On Tuesday morning, Hargrave's Facebook page was filled with supportive comments, some thanking her for taking a stand. Ms Hargrave told the board: "you're making our job more difficult" by not addressing valid pay concerns.