With 400 billion users, India has WhatsApp’s largest user base. But the online messenger app has recently come under scrutiny in the country, as well in several other regions, after two recent serious security breaches.
The Indian Computer Emergency Response Team (CERT), the nation’s main cybersecurity agency, has asked Indian WhatsApp users to update the application to the newest version. The notice was issued after Facebook, the owner of WhatsApp, revealed that a major potential problem has been found on older versions of the widely used app. CERT classified this as a “High Severity” threat.
What the problem is
If an unknown number has sent you an MP4 file via WhatsApp, watch out. You could have been a victim of the latest hacking scheme.
CERT has released an official statement on its website. The statement reveals that there is a vulnerability in WhatsApp’s system. It means that an unknown remote attacker could exploit this vulnerability to install malicious spyware on a user’s phone just by using an MP4 video file.
The spyware is encoded into a specifically made MP4 file. It could be triggered even without user authentication. Once the receiver of the message opens the video, the spyware is automatically installed on the phone.
After the spyware is installed, the attacker could make changes to the phone system. According to CERT, the spyware causes a condition called Remote Code Execution (RCE) of Denial of Service (DoS). In other words, the remote attacker could launch commands to compromise any device that uses Android, Apple, or Windows operating systems. This problem has serious far-reaching implications because no matter where the users are located, their phones can still be targeted.
The problem can be found in both individual and business versions of WhatsApp until the newest updates were launched in October this year.
Similarity to the Pegasus Breach
This security problem is discovered just after the Pegasus Breach controversy. Earlier this year, WhatsApp came under fire after it was made known that its software has been abused by hackers. The hackers utilize the loophole in the system to install spyware on phones. The name of the malware is Pegasus. It is said to have targeted journalists, activists, and human rights lawyers, jeopardizing their activities and privacy.
Similar to the MP4 video method, Pegasus is also spyware that installs itself on the target’s phone. However, it exploits a weakness in the messaging app’s video call function. It is also more advanced than the other method. Even if the user does not answer the suspicious call, the spyware can still breach the phone.
An Israel-based corporation, NSO Group, has undergone public scrutiny because it was accused of providing the Pegasus spyware. WhatsApp has sued the tech firm in a US court, alleging that NSO Group has violated the app’s terms and conditions and holds responsibility for the attacks. But the NSO Group claims that it only cooperates with government agencies.
WhatsApp had informed users whose devices are potentially breached by the spyware. In India, at least 17 individuals’ devices were infected by Pegasus. These included activists and lawyers who champion human rights, as well as journalists. The government has denied having any part in the hacking.
Security improvements by WhatsApp
Facebook and WhatsApp had announced that they have come up with a solution for the vulnerability a few days ago. WhatsApp’s statement says that the app is “constantly working to improve the security” of their service.
Both Facebook and WhatsApp have claimed that the most recent security patch from the application has resolved the vulnerability issue. And WhatsApp has no reason to believe that its users were affected, its spokesperson said. However, no further details about the counteracting measures have been disclosed.
The messenger boasts that its end-to-end encryption makes it a secure means of communication. The encryption means that the messages can only be read on the sender and the recipient’s devices. But the claim is debatable. The two recent scandals are not even the first time the application has been criticized for endangering the security and privacy of its users.
Currently, WhatsApp is the messaging app with the largest number of users. But some are migrating to other applications such as Telegram in search of a safer option. The developers of WhatsApp must look into potential vulnerabilities and reinforce their defenses so as to prevent losing current and potential users.
In the meantime, do not forget to update the application on your device. You should take this precaution so that you can avoid any potential security breach. Otherwise, your device might be compromised.
