Slashdot Mirror
Vulnerabilities In WhatsApp Web Affect Millions of Users Globally
An anonymous reader writes with an alert for anyone who uses the WhatsApp Web application. Check Point researcher Kasif Dekel, according to NetSecurity.Org, has discovered that "to exploit the vulnerability, an attacker simply needs to send a WhatsApp user a seemingly innocent vCard contact card, containing malicious code." When this card is opened from within the app, the executable it contains is run, "further compromising computers by distributing malware including ransomware, bots, remote access tools, and other types of malicious code."
Not all users need to panic about this vulnerability, though: the company has rolled out a fix, contained in all versions of WhatsApp Web after v0.1.4481. But with an estimated 200 million users of the web-based version, many users aren't yet using the updated version.
What's "WhatsApp" and why do we care?
Amusingly, my 'captcha' today is the word "stupid".
How can I find out what version of whatsapp web I'm running? I can't see the version number on the UI anywhere.
Not even sure what this is, but this might explain why I've started seeing spam messages telling me What's App sent me a message.
I have no idea what this app is, and I don't care ... I'm sure it's one of the endless stream of shitware out there whose sole purpose us to collect your data and deliver ads. I'm sure it pretends to do something useful to, like they all do. But all these apps and social media crap are really about two things: collecting your data and delivering ads.
And in all likelihood will be full of security holes, untrustworthy in terms of a privacy policy, and just as likely to get hacked on their server side as anything.
Yawn, wake me up with the golf rush of this shit has ended. This is why I have no interest in this crap ... because time and time again it proves itself to be broken, insecure, and run by shady people who only care about their profits.
Sorry, but that's not something I'm interested in. The only way to win is to not even play.
Lost at C:>. Found at C.
Whatsapp is quite popular in Brazil. Just saying...
Linux is for people who don't mind RTFM.
How can 200 million be affected by the web interface? I don't know what WhatsApp is (heard of it - never used it) I assume that "web" means web-server...and I thought that the power of the web was all clients are using the latest and greatest version all of the time.
To upgrade 200 million users - wouldn't I upgrade the web-server?
The article didn't get into the product design.
More and more I believe in the conclusion that the only real defense is to just not have the feature/app/whatever
This posting is provided 'AS IS' without warranty of any kind, implied or otherwise.
How can a web version not be rolled out to most people? If you refresh your web page it is updated - done. As the patch was released more than 10 days ago, surely most people had to refresh somewhere. Feels like just another sensational article to me...
Wait a second; what's the point of a vulnerability news article if it isn't to promote wild conjecture and attempt to insight panic?
The article referenced has a hear-say status. The Check Point blog has no entry on this vulnerability. Doesn't that sound curious at all? A InfoSec company not promoting the s%^& out of itself?
There are no good alternatives, though. XMPP, for example, is a huge effing mess and doesn't even properly support modern features. As an example, I have been trying to set up an XMPP-server of my own and for some reason Pidgin-users can transfer files to other Pidgin-users and Conversations (an Android-based XMPP-client) users can send files to other Conversations-users, but Pidgin-to-Conversations or Conversations-to-Pidgin doesn't work. All the things related to file-transfers and such are afterthoughts so it's no wonder, even; it was originally just meant for text-based chatting and that shines through everywhere.
As does BB10 OS in not having any of these ridiculous vulnerabilities.
I guess it's true, people really just don't care about security. Every week is an announcement of some massive hole in Androis, iOS, etc, and yet nobody considers moving to a free, secure, and feature-rich platform like BlackBerry.
Ever thought about sending your file by email? Why would we need a proprietary, non-standard communication protocol?
XMPP is not a proprietary protocol. Also, attaching images, sound-clips and short video-clips is a pretty common way of adding flavour to a conversation. E-mail is not an on-going live conversation, it's not comparable.
I suspect it's not that 200million people are vulnerable to this attack, but that 200million people have versions of WhatsApp installed that would be vulnerable if they were to use the web version. However, of those 200million people I would imagine only about five actually use the web version, which makes this vulnerability pretty insignificant.
The reason nobody would use the web version is because it's dreadful. You have to use your phone to scan a QR code off the monitor and then leave your phone connected while you send messages via your PC. It would be useful if you could use WhatsApp from your PC without having to use your phone to log in and stay connected, but unfortunately that's not the way it works.
Since you have to get your phone out, start up WhatsApp, scan a QR code and leave the phone connected, you may as well just send the messages from your phone as well. Overall it's less hassle than using the web client.
of course XMPP isn't. WhatsApp is.
XMPP is not a proprietary protocol. Also, attaching images, sound-clips and short video-clips is a pretty common way of adding flavour to a conversation. E-mail is not an on-going live conversation, it's not comparable.
Adding images, sound-clips and short video-clips sounds like a pretty common way to annoy who you are talking to. I hate instant message programs. They are a productivity killer. I see other people dropping what they are doing and instantly switching over to see what the latest "Ding!" was about. You might as well send me an e-mail because I will get to it when I have a moment, not immediately. If you require my 100% focus, arrange a meeting.
If you are not allowed to question your government then the government has answered your question.
A shit-written app for social-media numpties has a glaring vulnerability?? Geez, who coulda seen that coming??
Obligatory: I'm shocked, SHOCKED I TELL YOU!!
Just cruising through this digital world at 33 1/3 rpm...
I got the window open and I'm about to chuck my computer out of it.
Then you're clearly not the target audience here and your ranting is irrelevant.
I was talking about XMPP. Whatsapp at least handles all those more modern conversational features well and coherently, XMPP doesn't, and I am not aware of any other good open-source alternatives either. It's useless to rant about proprietary protocols when the available open-source protocols are so bad that no one would want to use them.
" As an example, I have been trying to set up an XMPP-server of my own and for some reason Pidgin-users can transfer files to other Pidgin-users and Conversations (an Android-based XMPP-client) users can send files to other Conversations-users, but Pidgin-to-Conversations or Conversations-to-Pidgin doesn't work."
That's because Pidgin is a piece of shit multi-client, even file transfers between Pidgin-Pidgin over Yahoo or AIM networks fail all the time. XMPP works just fine, it's fucking Pidgin.
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
They will be consumed as prey. Good for the rest of the herd.
Whatsapp is so bad that it works with phone numbers. Therefore it is so bad that I don't see why anyone would want to use it.
I don't see
Yes, that much is obvious at this point.
Your example of a conversational feature not handled well by XMPP but handled well by WhatsApp was "transferring files." This example is either irrelevant (no call to transfer files over chat in general, easy alternative of emailing files since xmpp addresses are email-shaped), or outright false (WhatsApp can't transfer files, can it? I thought it was single-endpoint-per-user, which must be a phone). Please come up with another example. I'm not saying there isn't one, just that you are muddle-headed and contributing noise.
This doesn't help normal people, only those white insurgents.
"When this card is opened from within the app, the executable is contains is run, "further compromising computers by distributing malware including ransomware, bots, remote access tools, and other types of malicious code."'
What platforms can this 'ransomware' run on to further compromise the device?
Attention last BlackBerry user!!!
Attention last BlackBerry user!!!
Please turn out the lights when you exit the building.
Thank you!
--- The Management