Flaw in WhatsApp and Signal exposes group chats to 'extremely difficult' hacks

Image Reuters
New security flaw allows hackers to eavesdrop on your Whats App chats 0

The researchers presented their findings at the Real World Cryptosecurity conference in Zurich on Wednesday (10 January), Wired reports.

Encryption has always been one of the more hard elements of group chat; the best protection in the world can not stop unintended readers from seeing messages once they've been decoded. But attackers that can control of a Threema server can replay messages or add a previously removed user back into a group, the researchers found. The WhatsApp servers can only be controlled by staff, governments who legally demand access, and high-level hackers.

Researchers at the Ruhr-Universität Bochum (RUB) in Germany found that anyone who controls WhatsApp or Signal servers can covertly add new members to any private group, allowing them to snoop on group conversations, all without the permission of the group administrator. This means that anyone who is able to gain access to the company's servers can spoof invitations and add themselves to a group, even making themselves the administrator.

Once a new member who is uninvited has been added to the group, the confidentiality of the group will be broken as the member can access all the new messages and read them, claims one of the researchers.

But management at WhatsApp's parent company, Facebook insisted that there was no security threat.

Perhaps even more troubling, a compromised admin with control of the server could manipulate the messages that would alert group members that someone new had been added, according to the researchers.

Facebook-owned WhatsApp added end-to-end encryption to every conversation two years ago. "We built WhatsApp so group messages can not be sent to a hidden user".

Riots in Pakistan over rape and murder of seven-year-old girl
Her family received footage showing her with a stranger near Peerowala Road, a video which has since gone viral on social media. Kasur had earlier hit the headlines in 2015 when a gang of paedophiles running a child sex ring was busted in the town.

Calvin Ridley will forgo his senior year, enter 2018 NFL Draft
His numbers rivaled former Alabama greats Amari Cooper and Julio Jones, both of whom were first-round selections in the NFL Draft. Alabama won its second national championship in three years Monday with a 26-23 overtime victory over Georgia.

Supreme Court to look at Ohio's voter-removal laws
He told a county election board official by email that he is a USA citizen born in OH and should be reinstated to the rolls. Harmon and his lawyers contend that the trigger for removal is in fact the failure to vote in two consecutive elections.

A flaw in popular encrypted chat programs WhatsApp, Threema and Signal theoretically allows nearly anyone to control important servers, bypass encryption and add themselves to group chats. While the vulnerability is not one that poses immediate concerns - it requires direct access to WhatsApp servers - it still raises questions about the security of the platform.

Now, it's important to note the limits of this security flaw: Whoever was exploiting it would have to be in control of the messaging app's servers.

It's not a problem that will impact most users, but chat apps like Signal and WhatsApp have been used for private conversations from everyone ranging from politicians to government dissenters.

But this new flaw means it would now technically be possible to infiltrate group messages, bypassing encryption.

New additions to the group chat would be notified to all members of the chat just like normal.

"He can cache all the messages and then decide which get sent to whom and which not", said Rösler when speaking to Wired. However, this potential gap in security should serve as a reminder for businesses and users to keep a close eye on their encryption services and their cryptographic keys, ' he adds. They will have to use the "Message Admin" button to post a message or share media to the group.

Stamos objected to the report, stating that there are multiple ways to check and verify the members of a group chat.

Related News:

  • Lenovo has a Google Home with a Display

    Lenovo has a Google Home with a Display

    LG is the third manufacturer to get on board the bandwagon as they too have announced the release of the LG ThinQ WK9. The whole idea behind Smart Displays is to serve as an in-house assistant for all your daily needs.
    Total War goes to China in Three Kingdoms

    Total War goes to China in Three Kingdoms

    It is a brutal and oppressive regime, and as Dong Zhuo's power grows, the empire slips further into the cauldron of anarchy. Total War: Three Kingdoms is without a hard release date as yet, but is expected at some point in autumn/fall 2018.
    Apple Store Evacuated After iPhone Battery Overheats, Filling Store With Smoke

    Apple Store Evacuated After iPhone Battery Overheats, Filling Store With Smoke

    The pressure from the United States follows action by the French government. Apple did not respond to the Journal's requests for comment on Tuesday.
  • Mobile's aggressive new smartphone promo includes high-profile iPhone X

    Mobile's aggressive new smartphone promo includes high-profile iPhone X

    Likewise, customers who buy a Galaxy Note 8 , S8 Active , or S8+ will get a $750 discount when they purchase a second phone. Starting this Friday, T-Mobile is offering a Buy One, Get One promo on smartphones from Samsung, LG, and Apple.
    Canada increasingly convinced Trump will pull out of NAFTA

    Canada increasingly convinced Trump will pull out of NAFTA

    If Trump did issue a withdrawal notice, it would open a six-month window before the USA would actually leave the deal. Mexico's Economy Ministry declined to comment on the report, a ministry spokesman said.
    Magnitude 7.6 quake hits Central America

    Magnitude 7.6 quake hits Central America

    A major natural disaster , one of the most severe in the past 100 years, struck off the coast of Honduras late Tuesday night. Authorities from Panama, Costa Rica, Nicaragua, Honduras, Guatemala and the Virgin Islands activated tsunami warnings.
  • Armed robbers steal millions from Ritz Paris hotel

    Armed robbers steal millions from Ritz Paris hotel

    The Luftwaffe set up their regional headquarters at the Ritz during the Second World War. "Passers-by took refuge in the hotel". Police stand in Rue Cambon at the back entrance of the Ritz luxury hotel in Paris on 10 January, 2018, after an armed robbery.
    Sweet dreams: a good night's sleep helps you cut sugar

    Sweet dreams: a good night's sleep helps you cut sugar

    In the study, 21 participants had sleep consultations in order to extend their visit to the land of nod by 90 minutes each night. Those who stay in bed longer were found to consume 2½ fewer teaspoons of sugar per day - around 40 calories.
    Tennessee pastor accused of sexual assault has book canceled

    Tennessee pastor accused of sexual assault has book canceled

    Lead Pastor Chris Conlee and the church leadership says it knew about the incident in Texas and has expressed support for Savage. Woodson wrote that Savage pulled over the vehicle , unzipped his jeans and pulled out his penis before asking her to suck it.
  • Jimmy Iovine Says He's Not Leaving Apple, Calls Rumours 'Fake News'

    Jimmy Iovine Says He's Not Leaving Apple, Calls Rumours 'Fake News'

    He also mentioned that he does not have a contract with Apple , he has a deal with it and there are a lot of details within. What do you think the future for Apple Music is? It is this original content which he puts down to their success.
    Barack Obama explains 'dad moves' on David Letterman's new Netflix talk show

    Barack Obama explains 'dad moves' on David Letterman's new Netflix talk show

    Says Obama, " Prince asks me to come up and dance [and] she pulls me up, which surprises me because she mocks my dancing". Meanwhile, the beard - you know which one and on whom - remains long and snow-white.
    Anthony Weiner and Huma Abedin have called off their divorce

    Anthony Weiner and Huma Abedin have called off their divorce

    One image depicted Weiner's crotch with his and Abedin's four-year-old son laying next to him. Abedin petitioned for separate in May, hours after Weiner conceded to sexting with a minor.


Most liked

Cyberpunk 2077's Twitter Account Teases about the Game?
Cyberpunk 2077 started off as a role-playing game, which is reported to be set in the open sci-fi world of Night City. Fist revealed back in 2013, that's also when communications from Cyberpunk 2077's Twitter account ceased.

Meghan Markle deletes social media accounts
Last month, the U.S. actress had 1.9 million people following her posts on Instagram , and more than 350,000 Twitter followers. She added that Ragland is so controlling that she wants to live with Markle and Harry in the palace after they get married.

NYC sues oil companies over climate change
Exxon Mobil responded to the news of the lawsuit in a blog , arguing that court cases aren't the best way to stop climate change. He and state Comptroller Thomas DiNapoli are creating an advisory committee to examine the way to proceed with divestment.

Isaiah Thomas was ejected for karate chopping Andrew Wiggins
All in all, it was an ugly performance for both Thomas and his team, who lost 127-99. I mean when guys seen it on film today, it was like, it was obvious.

State Department Rolls Out New Travel Advisory Program
Several European countries that are popular with American tourists were put at the Tier 2 level due to risks related to terrorism. India has been ranked Level 2 (exercise increased caution ) while Pakistan has been places in Level 3 (reconsider travel ).

Jay Bruce agrees to deal with New York Mets
Team officials have spoken in recent days to Jay Bruce's agent, and a reunion with the veteran outfielder remains a possibility. In 2017, he batted.254/.324/.508, had 29 doubles, two triples, 36 home runs, and drove in 101 runs with both teams.

The Black Widow Movie May Actually Be Moving Forward
Marvel fans no longer have to settle for the upcoming Red Sparrow movie: That Black Widow standalone is still happening. She is perhaps best known so far for the 2009 movie TiMER , a sci-fi comedy that she wrote, directed and produced.

NHL Announces Rosters for 2018 All-Star Game
The 6-foot-3, 210-pound defenseman was named a Second-Team NHL All-Star following both the 2011-12 and 2013-14 seasons. He's also known for making a splash on the red carpet, either at the all-star game or the NHL Awards show.

Trump instructed lawyer to induce AG to remain on Russian Federation case
Lawyers for the president have spoken with FBI investigators about a potential interview, three people familiar with the matter. The president's lawyers have previously stated their determination to cooperate with Mueller's requests.

Flu surge continues in Arizona — Health agency
"In more severe seasons, the flu causes approximately 700 deaths and almost 8,000 hospitalizations each year", said Dr. Schneider said the rise in positive flu cases could be attributed to better reporting on the physicians' part.

Vermont poised to enact legal pot through Legislature
Fifty-seven percent of Vermont voters support legal marijuana for adults, according to a March 2017 Public Policy Polling survey . Neighboring Massachusetts, nearby ME and six other states have legalized cannabis use as a result of voter initiatives.

Sevilla, United in ticket war
Ultimately Sevilla have not agreed to significantly lower the price to what we view as a reasonable level. United pledged any extra revenue would be donated to the club's foundation.

After Facing Harassment from Authorities, Pakistani Journalist Narrowly Escapes Abduction
According to the report, Siddiqui was reluctant to appear at the FIA headquarters in fear of harassment during interrogation. He also referred to the frequent kidnapping of journalists in Pakistan whenever they criticised the Pakistan's military.

J&K Assembly is most empowered in India: CM Mehbooba Mufti
"She should have expressed same sadness and anguish in house but she did not". This is unedited, unformatted feed from the Press Trust of India wire.

Twitch announces exclusive Overwatch League livestreaming deal
The Overwatch League will run, at the Blizzard Arena in Los Angeles, until June, with play-offs and finals scheduled for July. The deal, announced yesterday, is believed to be the biggest exclusive distribution deal in esports history.