Tuesday, May 28, 2024

WhatsApp Image Filter Bug Let Hackers Steal Sensitive Data

The cybersecurity researchers of Check Point Software Technologies Ltd have recently detected a security vulnerability in the image filtering function of WhatsApp, the world’s most famous messaging application that has active users more than 2 billion.

The news gets disclosed an hour after knowing that WhatsApp will have to pay 225 million dollars for not complying with the Data Protection Law. 

According to the security research of the Check Point, WhatsApp has been notified about this attack and luckily the problem was resolved immediately. 

The experts claimed that by implementing certain filters to a particularly crafted image and transferring it to a potential victim, the threat actors could exploit the vulnerability and obtain access to private data from WhatsApp’s memory.

Technical details

The cybersecurity analysts started an investigation to know all the details regarding this attack, however, they detected that during this attack the threat actors have sent nearly 55 billion messages daily over WhatsApp, and with 4.5 billion photos and 1 billion videos has been shared per day.

During the investigation, they have generally focused on few image types such as bmp, ico, gif, jpeg, and png, and used AFL fuzzing lab at Check Point to create distorted files.

They also notice that some of the images couldn’t be sent, thus they searched for other means of using those images, and during one operation they thought of was image filters.

Moreover, the threat actors have discovered that changing between various filters on the crafted GIF files certainly causing WhatsApp to crash.

The Flaw: CVE-2020-1910

However, after knowing some of the mere details regarding this attack, the researchers reverse-engineered the libwhatsapp.so library and applied a debugger so that they can analyze the root cause of the attack.

After performing the procedure they came to know that the vulnerability (CVE-2020-1910) remains in a native function applyFilterIntoBuffer() in libwhatsapp.so library.

WhatsApp’s Response

After knowing about this attack, WhatsApp has disclosed this bug within its February 2021 Security Advisory Report. Apart from all this WhatsApp asserted that they always work with security experts when they encounter such unwanted situations. 

However, they also claimed in their report that users should not have any doubt that end-to-end encryption remains to work as it was expected and their messages continue to be safe and secure.

According to WhatsApp, every user should keep their apps and operating systems updated, that’s why always download the updates whenever they’re available, as it will help to report questionable messages.

WhatsApp fix

For this new attack, WhatsApp has introduced the fix in version and published it in their February Security Advisory update.

However, this fixed-function has been introduced with two new checks on the source image and filter image:-

  • Verifies that the image format equals 1 (ANDROID_BITMAP_FORMAT_RGBA_8888): This implies that both source and filter images should be in RGBA format.
  • Verifies the image size by monitoring that the (stride*height)/4 equals width*height: Because “stride” equals the number of bytes per pixel calculated by width, the second check actually assures that the image surely has 4 bytes per pixel.

While the security analysts stated that users should follow the fix carefully, as it will help them to bypass such situations and thus they can keep their sensitive data safe and secure.


Latest articles

GNOME Remote Desktop Vulnerability Let Attackers Read Login Credentials

GNOME desktop manager was equipped with a new feature which allowed remote users to...

Kesakode: A Remote Hash Lookup Service To Identify Malware Samples

Today marks a significant milestone for Malcat users with the release of version 0.9.6,...

Cisco Firepower Vulnerability Let Attackers Launch SQL Injection Attacks

 A critical vulnerability has been identified in Cisco Firepower Management Center (FMC) Software's web-based...

Hackers Exploit WordPress Plugin to Steal Credit Card Data

Hackers have exploited an obscure WordPress plugin to inject malware into websites, specifically targeting...

Google Patches Chrome Zero-Day: Type Confusion in V8 JavaScript

Google has released a patch for a zero-day exploit in its Chrome browser.The...

Hackers Created Rogue VMs in Recent MITRE’s Cyber Attack

State-sponsored hackers recently exploited vulnerabilities in MITRE's Networked Experimentation, Research, and Virtualization Environment (NERVE).They...

Hackers Weaponizing Microsoft Access Documents To Execute Malicious Program

In multiple aggressive phishing attempts, the financially motivated organization UAC-0006 heavily targeted Ukraine, utilizing...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Free Webinar

Live API Attack Simulation

94% of organizations experience security problems in production APIs, and one in five suffers a data breach. As a result, cyber-attacks on APIs increased from 35% in 2022 to 46% in 2023, and this trend continues to rise.
Key takeaways include:

  • An exploit of OWASP API Top 10 vulnerability
  • A brute force ATO (Account Takeover) attack on API
  • A DDoS attack on an API
  • Positive security model automation to prevent API attacks

Related Articles