• Home
  • Apps
  • Apps News
  • WhatsApp Security Flaw Can Allow Strangers Add Themselves to Group Chats: Researchers

WhatsApp Security Flaw Can Allow Strangers Add Themselves to Group Chats: Researchers

Share on Facebook Tweet Share Share Reddit Comment
WhatsApp Security Flaw Can Allow Strangers Add Themselves to Group Chats: Researchers

Highlights

  • Researchers have found a way to snoop on WhatsApp groups
  • It requires control over the WhatsApp servers
  • Messages sent before this attack still can't be seen

At the Real World Crypto security conference in Switzerland, a group of German researchers announced that they have discovered flaws in WhatsApp's end-to-end encryption.

According to a report in Wired, the researchers say that anyone who controls WhatsApp's servers can add people into private group chats, without getting the admin's permission. The new member would be able to read all messages going forward, breaking the confidentiality of the group and negating end-to-end encryption.

"The confidentiality of the group is broken as soon as the uninvited member can obtain all the new messages and read them," Wired quotes Paul Rösler, one of the Ruhr University researchers who co-authored a paper on the group messaging vulnerabilities, as saying. "If I hear there's end-to-end encryption for both groups and two-party communications, that means adding of new members should be protected against. And if not, the value of encryption is very little."

Although this is a serious concern, the requirement that this method has of controlling WhatsApp servers would appear to limit the risk factors a little. Extremely sophisticated hackers, WhatsApp's own staff, and state actors are the different kinds of people who would be able to exploit this. And even then, all messages previous to the insertion of a new member would remain private.

Facebook’s Chief Security Officer Alex Stamos, responding to the report on Twitter, said, “Read the Wired article today about WhatsApp – scary headline! But there is no [sic] a secret way into WhatsApp groups chats.”

Stamos further pointed out in his tweets that everyone in the group would see a message that a new member has joined, so this wouldn't be a stealthy strategy for government spying.

"On WhatsApp, existing members of a group are notified when new people are added," he tweeted. "WhatsApp is built so group messages cannot be send [sic] to hidden users and provides multiple ways for users to confirm who receives a message prior to it being sent."

He added that the report has been looked at carefully, and while there may be a way to add more protections, it's not clear cut. "In sum, the clear notifications and multiple ways of checking who is in your group prevent silent eavesdropping," he wrote. "The content of messages sent in WhatsApp groups remain protected by end-to-end encryption."

Comments

For the latest tech news and reviews, follow Gadgets 360 on Twitter, Facebook, and subscribe to our YouTube channel.

Gadgets 360 Staff The resident bot. If you email me, a human will respond. More
CES 2018: Alcatel 1X, Alcatel 3V, Alcatel 5 Smartphones With 18:9 Full View Displays Unveiled
YouTube Pares Back Logan Paul Partnership After Suicide Video Post
 
 

Advertisement

 

Advertisement