WhatsApp user chats on Android liable to theft due to file system flaw

A newly discovered security flaw in the Android version of WhatsApp allows another application to upload a user’s entire database of chats...

A newly discovered security flaw in the Android version of WhatsApp allows another application to upload a user’s entire database of chats to a third-party server, without their consent.

The error stems from the Android operating system’s handling of external storage, as well as lax security standards in the WhatsApp application itself.

As detailed by Bas Bosschert, a dutch security consultant, the flaw allows any Android application with access to the device’s SD card to read and upload WhatsApp’s database.

“The WhatsApp database is saved on the SD card which can be read by any Android application if the user allows it to access the SD card,” Bosschert says. “And, as the majority of people allow everything on their Android device, this is not much of a problem.”

Android’s part in the weakness comes from the fact that the operating system only allows all-or-nothing access to the SD card. Any application which can read and write to the external storage can thus also read what other applications have stored there.

WhatsApp not only uses that external storage to hold its database, but on earlier versions of the app, does so without any encryption at all.

Bosschert adds that even later versions, which encrypt the database, do so using a key which can be easily extracted from the app using third-party tools like WhatsApp Xtract.

He concludes that “every application can read the WhatsApp database and it is also possible to read the chats from the encrypted databases.

“Facebook didn’t need to buy WhatsApp to read your chats.”

In order to avoid the risk of having their chats stolen, users should be wary of granting suspicious apps access to the SD card; a theoretical example given by Bosschert is a Flappy Bird clone app. If the application is from an untrusted publisher, they should exercise caution over granting the permissions it requests upon launch, especially if they include access to the SD card.

Opinion is split over whether WhatsApp or Android itself is more to blame for the flaw. Android’s policy of allowing total access to the SD card is at odds with Apple’s far more controlled security on iOS devices, where every app is “sandboxed” in a way that prevents others from accessing its data.

That Android openness allows developers to build programs which would be impossible on an iOS device, but also opens up the risk of errors such as that which has affected WhatsApp.

But this breach is the latest in a long string of security holes at WhatsApp. In October, a security researcher showed that it was possible to decrypt messages as they were sent using no more than data gained through eavesdropping on the WhatsApp connection.

And security researchers point out that one of the flaws which enabled this latest attack has been known about for more than a year; the WhatsApp Xtract tool, used to decrypted the database, was released in May 2012.

“Embedding cryptography into any product entails many subtleties, both at the granular level of code, and at the level of architecture,” explains Adrian Culley, Global Technical Consultant at Damballa. “In the fast moving world of mobile apps, advice is not always sought from skilled cryptographers at an early enough stage in development.”

WhatsApp, in an FAQ on its site, says that “WhatsApp communication between your phone and our server is encrypted.”
कृपया हामी संग फेसबुकमा जोडिन लाइक र पोस्ट शेयर गर्नुहोस

नया भिडियोहरु


Adhunik Songs,66,Amazing,2,Beauty,1,education,1,Europe,16,Fashion,9,film songs,75,Gossip news,1,Health,2,Life,1,Live Stage,9,lounge & Baar,1,movie,10,MUsic,24,music award,1,Music Vdo,2,Nepali movie,3,nepali pop,157,Recents,590,Show,25,social work,1,sports,1,Tihar Songs,5,trailers,52,पोस्टर रिलिज,1,
EuropeNepal.Net: WhatsApp user chats on Android liable to theft due to file system flaw
WhatsApp user chats on Android liable to theft due to file system flaw
Loaded All Posts Not found any posts VIEW ALL Readmore Reply Cancel reply Delete By Home PAGES POSTS View All RECOMMENDED FOR YOU LABEL ARCHIVE SEARCH ALL POSTS Not found any post match with your request Back Home Sunday Monday Tuesday Wednesday Thursday Friday Saturday Sun Mon Tue Wed Thu Fri Sat January February March April May June July August September October November December Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec just now 1 minute ago $$1$$ minutes ago 1 hour ago $$1$$ hours ago Yesterday $$1$$ days ago $$1$$ weeks ago more than 5 weeks ago Followers Follow THIS CONTENT IS PREMIUM Please share to unlock Copy All Code Select All Code All codes were copied to your clipboard Can not copy the codes / texts, please press [CTRL]+[C] (or CMD+C with Mac) to copy