Flaw in WhatsApp and Signal exposes group chats to 'extremely difficult' hacks

Image Reuters
New security flaw allows hackers to eavesdrop on your Whats App chats 0

The researchers presented their findings at the Real World Cryptosecurity conference in Zurich on Wednesday (10 January), Wired reports.

Encryption has always been one of the more hard elements of group chat; the best protection in the world can not stop unintended readers from seeing messages once they've been decoded. But attackers that can control of a Threema server can replay messages or add a previously removed user back into a group, the researchers found. The WhatsApp servers can only be controlled by staff, governments who legally demand access, and high-level hackers.

Researchers at the Ruhr-Universität Bochum (RUB) in Germany found that anyone who controls WhatsApp or Signal servers can covertly add new members to any private group, allowing them to snoop on group conversations, all without the permission of the group administrator. This means that anyone who is able to gain access to the company's servers can spoof invitations and add themselves to a group, even making themselves the administrator.

Once a new member who is uninvited has been added to the group, the confidentiality of the group will be broken as the member can access all the new messages and read them, claims one of the researchers.

But management at WhatsApp's parent company, Facebook insisted that there was no security threat.

Perhaps even more troubling, a compromised admin with control of the server could manipulate the messages that would alert group members that someone new had been added, according to the researchers.

Facebook-owned WhatsApp added end-to-end encryption to every conversation two years ago. "We built WhatsApp so group messages can not be sent to a hidden user".

Riots in Pakistan over rape and murder of seven-year-old girl
Her family received footage showing her with a stranger near Peerowala Road, a video which has since gone viral on social media. Kasur had earlier hit the headlines in 2015 when a gang of paedophiles running a child sex ring was busted in the town.

Tennessee pastor accused of sexual assault has book canceled
Lead Pastor Chris Conlee and the church leadership says it knew about the incident in Texas and has expressed support for Savage. Woodson wrote that Savage pulled over the vehicle , unzipped his jeans and pulled out his penis before asking her to suck it.

After Facing Harassment from Authorities, Pakistani Journalist Narrowly Escapes Abduction
According to the report, Siddiqui was reluctant to appear at the FIA headquarters in fear of harassment during interrogation. He also referred to the frequent kidnapping of journalists in Pakistan whenever they criticised the Pakistan's military.

A flaw in popular encrypted chat programs WhatsApp, Threema and Signal theoretically allows nearly anyone to control important servers, bypass encryption and add themselves to group chats. While the vulnerability is not one that poses immediate concerns - it requires direct access to WhatsApp servers - it still raises questions about the security of the platform.

Now, it's important to note the limits of this security flaw: Whoever was exploiting it would have to be in control of the messaging app's servers.

It's not a problem that will impact most users, but chat apps like Signal and WhatsApp have been used for private conversations from everyone ranging from politicians to government dissenters.

But this new flaw means it would now technically be possible to infiltrate group messages, bypassing encryption.

New additions to the group chat would be notified to all members of the chat just like normal.

"He can cache all the messages and then decide which get sent to whom and which not", said Rösler when speaking to Wired. However, this potential gap in security should serve as a reminder for businesses and users to keep a close eye on their encryption services and their cryptographic keys, ' he adds. They will have to use the "Message Admin" button to post a message or share media to the group.

Stamos objected to the report, stating that there are multiple ways to check and verify the members of a group chat.

Related News:



Most liked

The New 2019 Ford Edge ST Is The Sharpest Yet
The Dearborn-based automaker sold 142,603 Edges previous year , making it the third-best selling SUV for the company. But Aquino and others noted that all the technology wouldn't be worth much if the Edge wasn't a fun ride.

Isaiah Thomas was ejected for karate chopping Andrew Wiggins
All in all, it was an ugly performance for both Thomas and his team, who lost 127-99. I mean when guys seen it on film today, it was like, it was obvious.

Jay Bruce agrees to deal with New York Mets
Team officials have spoken in recent days to Jay Bruce's agent, and a reunion with the veteran outfielder remains a possibility. In 2017, he batted.254/.324/.508, had 29 doubles, two triples, 36 home runs, and drove in 101 runs with both teams.

Blood shortage may lead to delay of medical procedures — Red Cross
Regina Boothe Bratton from American Red Cross says,"We did not collect up to 5,500 blood and platelet donations". There can be up to about a dozen (or more! ) places for Coloradans to donate blood on any given day.

Steve Kerr Says Steph Curry's Latest Ankle Injury is Not Serious
He's listed at 6-9 (but closer to seven-feet) with a wingspan around 7-4 or 7-5. As for the health of Curry, the injury to his right ankle doesn't sound serious.

Canada increasingly convinced Trump will pull out of NAFTA
If Trump did issue a withdrawal notice, it would open a six-month window before the USA would actually leave the deal. Mexico's Economy Ministry declined to comment on the report, a ministry spokesman said.

NHL Announces Rosters for 2018 All-Star Game
The 6-foot-3, 210-pound defenseman was named a Second-Team NHL All-Star following both the 2011-12 and 2013-14 seasons. He's also known for making a splash on the red carpet, either at the all-star game or the NHL Awards show.

Kylie Jenner Freaking Out Over 60 Pound Pregnancy Weight Gain
A source told Us Weekly that there is a simple reason why Jenner prefers to remain out of the spotlight during her pregnancy. The rumor mill revealed that she has been dumped by the father of her alleged baby, #Travis Scott .

Trump instructed lawyer to induce AG to remain on Russian Federation case
Lawyers for the president have spoken with FBI investigators about a potential interview, three people familiar with the matter. The president's lawyers have previously stated their determination to cooperate with Mueller's requests.

Total War goes to China in Three Kingdoms
It is a brutal and oppressive regime, and as Dong Zhuo's power grows, the empire slips further into the cauldron of anarchy. Total War: Three Kingdoms is without a hard release date as yet, but is expected at some point in autumn/fall 2018.

Flu surge continues in Arizona — Health agency
"In more severe seasons, the flu causes approximately 700 deaths and almost 8,000 hospitalizations each year", said Dr. Schneider said the rise in positive flu cases could be attributed to better reporting on the physicians' part.

Vermont poised to enact legal pot through Legislature
Fifty-seven percent of Vermont voters support legal marijuana for adults, according to a March 2017 Public Policy Polling survey . Neighboring Massachusetts, nearby ME and six other states have legalized cannabis use as a result of voter initiatives.

Supreme Court to look at Ohio's voter-removal laws
He told a county election board official by email that he is a USA citizen born in OH and should be reinstated to the rolls. Harmon and his lawyers contend that the trigger for removal is in fact the failure to vote in two consecutive elections.

J&K Assembly is most empowered in India: CM Mehbooba Mufti
"She should have expressed same sadness and anguish in house but she did not". This is unedited, unformatted feed from the Press Trust of India wire.

Twitch announces exclusive Overwatch League livestreaming deal
The Overwatch League will run, at the Blizzard Arena in Los Angeles, until June, with play-offs and finals scheduled for July. The deal, announced yesterday, is believed to be the biggest exclusive distribution deal in esports history.