Thursday, March 28, 2024

WhatsApp Image Filter Bug Let Hackers Steal Sensitive Data

The cybersecurity researchers of Check Point Software Technologies Ltd have recently detected a security vulnerability in the image filtering function of WhatsApp, the world’s most famous messaging application that has active users more than 2 billion.

The news gets disclosed an hour after knowing that WhatsApp will have to pay 225 million dollars for not complying with the Data Protection Law. 

According to the security research of the Check Point, WhatsApp has been notified about this attack and luckily the problem was resolved immediately. 

The experts claimed that by implementing certain filters to a particularly crafted image and transferring it to a potential victim, the threat actors could exploit the vulnerability and obtain access to private data from WhatsApp’s memory.

Technical details

The cybersecurity analysts started an investigation to know all the details regarding this attack, however, they detected that during this attack the threat actors have sent nearly 55 billion messages daily over WhatsApp, and with 4.5 billion photos and 1 billion videos has been shared per day.

During the investigation, they have generally focused on few image types such as bmp, ico, gif, jpeg, and png, and used AFL fuzzing lab at Check Point to create distorted files.

They also notice that some of the images couldn’t be sent, thus they searched for other means of using those images, and during one operation they thought of was image filters.

Moreover, the threat actors have discovered that changing between various filters on the crafted GIF files certainly causing WhatsApp to crash.

The Flaw: CVE-2020-1910

However, after knowing some of the mere details regarding this attack, the researchers reverse-engineered the libwhatsapp.so library and applied a debugger so that they can analyze the root cause of the attack.

After performing the procedure they came to know that the vulnerability (CVE-2020-1910) remains in a native function applyFilterIntoBuffer() in libwhatsapp.so library.

WhatsApp’s Response

After knowing about this attack, WhatsApp has disclosed this bug within its February 2021 Security Advisory Report. Apart from all this WhatsApp asserted that they always work with security experts when they encounter such unwanted situations. 

However, they also claimed in their report that users should not have any doubt that end-to-end encryption remains to work as it was expected and their messages continue to be safe and secure.

According to WhatsApp, every user should keep their apps and operating systems updated, that’s why always download the updates whenever they’re available, as it will help to report questionable messages.

WhatsApp fix

For this new attack, WhatsApp has introduced the fix in version 2.21.1.13 and published it in their February Security Advisory update.

However, this fixed-function has been introduced with two new checks on the source image and filter image:-

  • Verifies that the image format equals 1 (ANDROID_BITMAP_FORMAT_RGBA_8888): This implies that both source and filter images should be in RGBA format.
  • Verifies the image size by monitoring that the (stride*height)/4 equals width*height: Because “stride” equals the number of bytes per pixel calculated by width, the second check actually assures that the image surely has 4 bytes per pixel.

While the security analysts stated that users should follow the fix carefully, as it will help them to bypass such situations and thus they can keep their sensitive data safe and secure.

Website

Latest articles

GoPlus’s Latest Report Highlights How Blockchain Communities Are Leveraging Critical API Security Data To Mitigate Web3 Threats

GoPlus Labs, the leading Web3 security infrastructure provider, has unveiled a groundbreaking report highlighting...

Wireshark 4.2.4 Released: What’s New!

Wireshark stands as the undisputed leader, offering unparalleled tools for troubleshooting, analysis, development, and...

Zoom Unveils AI-Powered All-In-One AI Work Workplace

Zoom has taken a monumental leap forward by introducing Zoom Workplace, an all-encompassing AI-powered...

iPhone Users Beware! Darcula Phishing Service Attacking Via iMessage

Phishing allows hackers to exploit human vulnerabilities and trick users into revealing sensitive information...

2 Chrome Zero-Days Exploited at Pwn2Own 2024: Patch Now

Google has announced a crucial update to its Chrome browser, addressing several vulnerabilities, including...

The Moon Malware Hacked 6,000 ASUS Routers in 72hours to Use for Proxy

Black Lotus Labs discovered a multi-year campaign by TheMoon malware targeting vulnerable routers and...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles