Slashdot Mirror

← Back to Stories (view on slashdot.org)

Israel Sends Nation-Wide Security Alert Following Reports About Hijacked WhatsApp Accounts (zdnet.com)

Posted by msmash on from the privacy-woes dept.

A wave of reports about hijacked WhatsApp accounts in Israel has forced the government's cyber-security agency to send out a nation-wide security alert on Tuesday, ZDNet has learned. From a report: The alert, authored by the Israel National Cyber Security Authority, warns about a relatively new method of hijacking WhatsApp accounts using mobile providers' voicemail systems. This new hacking method was first documented last year by Ran Bar-Zik, an Israeli web developer at Oath. The general idea is that users who have voicemail accounts for their phone numbers are at risk if they don't change that account's default password, which in most cases tends to be either 0000 or 1234. The possibility of an account takeover happens when an attacker tries to add a legitimate user's phone number to a new WhatsApp app installation on his own phone. Following normal security procedures, the WhatsApp service would then send a one-time code via SMS to that phone number. This would typically alert a user to an ongoing attack, but Bar-Zik argues that a hacker could easily avoid this by carrying out the attack during nighttime or when he is sure the user is away from his phone.

10 of 25 comments (clear)

  1. Default passwords by syn3rg · · Score: 1

    strike again...

    --
    The contents of this message have been doubly encrypted by ROT13
  2. Text envy by XXongo · · Score: 1

    Looks like they heard that the U.S. was doing an emergency broadcast text to everybody in the country, and decided that they wanted to do one, too.

  3. This is fake by lucasnate1 · · Score: 2

    I am Israeli and got no such message.

    --
    Avantgarde Hebrew science fiction
    1. Re:This is fake by Anonymous Coward · · Score: 1

      You got the message, but I deleted it before you read it. Sorry.

    2. Re:This is fake by Gravis+Zero · · Score: 1

      I am Israeli and got no such message.

      Here's the important part: are you currently located in Israel? ;)

      --
      Anons need not reply. Questions end with a question mark.
    3. Re: This is fake by lucasnate1 · · Score: 2

      Yes

      --
      Avantgarde Hebrew science fiction
  4. What is the point of WhatApp anyway? by ctilsie242 · · Score: 2

    I've wondered about something like a UL listing, done by a non-partisan group, but would review offerings (be it apps or hardware devices) on the security they provided. This would be at different levels, similar to Europe's Sold Secure bronze/silver/gold ratings. This way, one could tell a service that offered end to end encryption and proper, auditable procedure versus some a company that has security as an afterthought at best.

    I don't get the point of WhatsApp. If I want solid security, there is Signal and Telegram, both have good ratings. If I need a "corporate" messaging app, there is Slack and Skype for Business. Even Facebook Messenger can do end to end encryption with its "secret" functionality uses Signal's protocol. Why do I need an insecure messaging app when there is so much better out there?

    1. Re:What is the point of WhatApp anyway? by fph+il+quozientatore · · Score: 1

      Because I can't convince all the normies around me to abandon it and switch to Signal.

      --
      My first program:

      Hell Segmentation fault

    2. Re:What is the point of WhatApp anyway? by stephanruby · · Score: 1

      Why do I need an insecure messaging app when there is so much better out there?

      Because that would require you to convince all your relatives and friends to switch to a more secure app, which is easier said than done.

  5. Re:creimer is fat and a gay! Everybody say yay! by CaptainDork · · Score: 1

    Is creimer orange?

    --
    It little behooves the best of us to comment on the rest of us.