Skip to main content

How to Hack WhatsApp using just a GIF

By

A picture is worth a thousand words, but a GIF is worth a thousand pictures.

Today, the short looping clips, GIFs are everywhere—on your social media, on your message boards, on your chats, helping users perfectly express their emotions, making people laugh, and reliving a highlight.

But what if an innocent-looking GIF greeting with Good morning, Happy Birthday, or Merry Christmas message hacks your smartphone?

Well, not a theoretical idea anymore.
WhatsApp has recently patched a critical security vulnerability in its app for Android, which remained unpatched for at least 3 months after being discovered, and if exploited, could have allowed remote hackers to compromise Android devices and potentially steal files and chat messages.

WhatsApp Remote Code Execution Vulnerability


The vulnerability, tracked as CVE-2019-11932, is a double-free memory corruption bug that doesn't actually reside in the WhatsApp code itself, but in an open-source GIF image parsing library that WhatsApp uses.
Discovered by Vietnamese security researcher Pham Hong Nhat in May this year, the issue successfully leads to remote code execution attacks, enabling attackers to execute arbitrary code on targeted devices in the context of WhatsApp with the permissions the app has on the device.

"The payload is executed under WhatsApp context. Therefore it has the permission to read the SDCard and access the WhatsApp message database," the researcher told The Hacker News in an email interview.

"Malicious code will have all the permissions that WhatsApp has, including recording audio, accessing the camera, accessing the file system, as well as WhatsApp's sandbox storage that includes protected chat database and so on…"

How Does WhatsApp RCE Vulnerability Work?


WhatsApp uses the parsing library in question to generate a preview for GIF files when users open their device gallery before sending any media file to their friends or family.

Thus, to be noted, the vulnerability does not get triggered by sending a malicious GIF file to a victim; instead it gets executed when the victim itself simply opens the WhatsApp Gallery Picker while trying to send any media file to someone.

To exploit this issue, all an attacker needs to do is send a specially crafted malicious GIF file to a targeted Android user via any online communication channel and wait for the user to just open the image gallery in WhatsApp.

However, if attackers want to send the GIF file to victims via any messaging platform like WhatsApp or Messenger, they need to send it as a document file rather than media file attachments, because image compression used by these services distorts the malicious payload hidden in images.
As shown in a proof-of-concept video demonstration the researcher shared with The Hacker News, the vulnerability can also be exploited to simply pop-up a reverse shell remotely from the hacked device.

Vulnerable Apps, Devices and Available Patches


The issue affects WhatsApp versions 2.19.230 and older versions running on Android 8.1 and 9.0, but does not work for Android 8.0 and below.

"In the older Android versions, double-free could still be triggered. However, because of the malloc calls by the system after the double-free, the app just crashes before reaching to the point that we could control the PC register," the researcher writes.

Nhat told The Hacker News that he reported the vulnerability to Facebook, who owns WhatsApp, in late July this year, and the company included a security patch in WhatsApp version 2.19.244, released in September.

Therefore, to protect yourself against any exploit surrounding this vulnerability, you are recommended to update your WhatsApp to the latest version from the Google Play Store as soon as possible.

Besides this, since the flaw resides in an open-source library, it is also possible that any other Android app using the same affected library could also be vulnerable to similar attacks.

The developer of the affected GIF library, called Android GIF Drawable, has also released version 1.2.18 of the software to patch the double-free vulnerability.

WhatsApp for iOS is not affected by this vulnerability.

Source: TheHackerNews

Labels:

Comments

Post a Comment

Popular posts from this blog

10 Best Forum Software For Webmasters

By
10 Best Forum Software For Webmasters Do you want to create your online discussion forum or online community where people can discuss about their favorite topics? In this article, you can see 10 best forum software (scripts for setting up discussion forums) that can be used free of cost. Although some scripts are paid but rest of these forum scripts are free to use.You only need to buy hosting space and domain name for your website and after then you can install any of these forum scripts to start your own discussion forums on the internet. Online discussion forums generate huge page views because thousands of people want to join online discussion forums to ask questions or share knowledge. Some of online marketers join forums to discuss about their products with community members. You don't need to acquire any kind of technical skill to run a professional discussion forums because these days, almost all web hosting providers offer one click script installer which h...
Post a Comment
Read more

|Bypass Symlink on 2013 Server With Different .htaccess and Methods by Sen Haxor |

By
Hi, Guys,  Please a wonderfull tutorial provided bt Sem;\  Today I gonna Explain how to bypass Symlink on 2013 Server With Different .htaccess and Methods. So let's Get Started :) Note: This method is not applicable for Godaddy, Bluehost, Hostgator and Hostmonstor Servers. For This First You Need the Following Files : 1 -> Sen Haxor CGI Shell 2 -> sen.zip 3 -> passwd-bypass.php 4 -> Turbo Brute force Cpanel 5 - > Port.py First Before Starting to symlink we need to create php.ini and ini.php to Disable Safe mode and Disabled Functions on the server . Use the Following Code : Make a php.ini with the following code safe_mode=Off And ini.php with <? echo ini_get("safe_mode"); echo ini_get("open_basedir"); include($_GET["file"]); ini_restore("safe_mode"); ini_restore("open_basedir"); echo ini_get("safe_mode"); echo...
Post a Comment
Read more