WhatsApp Image Filter Bug Let Hackers Steal Sensitive Data

The cybersecurity researchers of Check Point Software Technologies Ltd have recently detected a security vulnerability in the image filtering function of WhatsApp, the world’s most famous messaging application that has active users more than 2 billion.

The news gets disclosed an hour after knowing that WhatsApp will have to pay 225 million dollars for not complying with the Data Protection Law. 

According to the security research of the Check Point, WhatsApp has been notified about this attack and luckily the problem was resolved immediately. 

The experts claimed that by implementing certain filters to a particularly crafted image and transferring it to a potential victim, the threat actors could exploit the vulnerability and obtain access to private data from WhatsApp’s memory.

Technical details

The cybersecurity analysts started an investigation to know all the details regarding this attack, however, they detected that during this attack the threat actors have sent nearly 55 billion messages daily over WhatsApp, and with 4.5 billion photos and 1 billion videos has been shared per day.

During the investigation, they have generally focused on few image types such as bmp, ico, gif, jpeg, and png, and used AFL fuzzing lab at Check Point to create distorted files.

They also notice that some of the images couldn’t be sent, thus they searched for other means of using those images, and during one operation they thought of was image filters.

Moreover, the threat actors have discovered that changing between various filters on the crafted GIF files certainly causing WhatsApp to crash.

The Flaw: CVE-2020-1910

However, after knowing some of the mere details regarding this attack, the researchers reverse-engineered the libwhatsapp.so library and applied a debugger so that they can analyze the root cause of the attack.

After performing the procedure they came to know that the vulnerability (CVE-2020-1910) remains in a native function applyFilterIntoBuffer() in libwhatsapp.so library.

WhatsApp’s Response

After knowing about this attack, WhatsApp has disclosed this bug within its February 2021 Security Advisory Report. Apart from all this WhatsApp asserted that they always work with security experts when they encounter such unwanted situations. 

However, they also claimed in their report that users should not have any doubt that end-to-end encryption remains to work as it was expected and their messages continue to be safe and secure.

According to WhatsApp, every user should keep their apps and operating systems updated, that’s why always download the updates whenever they’re available, as it will help to report questionable messages.

WhatsApp fix

For this new attack, WhatsApp has introduced the fix in version 2.21.1.13 and published it in their February Security Advisory update.

However, this fixed-function has been introduced with two new checks on the source image and filter image:-

• Verifies that the image format equals 1 (ANDROID_BITMAP_FORMAT_RGBA_8888): This implies that both source and filter images should be in RGBA format.
• Verifies the image size by monitoring that the (stride*height)/4 equals width*height: Because “stride” equals the number of bytes per pixel calculated by width, the second check actually assures that the image surely has 4 bytes per pixel.

While the security analysts stated that users should follow the fix carefully, as it will help them to bypass such situations and thus they can keep their sensitive data safe and secure.