Friday, February 26, 2021
  • Setup menu at Appearance » Menus and assign menu to Top Bar Navigation
Advertisement
  • AI Development
    • Artificial Intelligence
    • Machine Learning
    • Neural Networks
    • Learn to Code
  • Data
    • Blockchain
    • Big Data
    • Data Science
  • IT Security
    • Internet Privacy
    • Internet Security
  • Marketing
    • Digital Marketing
    • Marketing Technology
  • Technology Companies
  • Crypto News
No Result
View All Result
NikolaNews
  • AI Development
    • Artificial Intelligence
    • Machine Learning
    • Neural Networks
    • Learn to Code
  • Data
    • Blockchain
    • Big Data
    • Data Science
  • IT Security
    • Internet Privacy
    • Internet Security
  • Marketing
    • Digital Marketing
    • Marketing Technology
  • Technology Companies
  • Crypto News
No Result
View All Result
NikolaNews
No Result
View All Result
Home Internet Privacy

Just a GIF Image Could Have Hacked Your Android Phone Using WhatsApp

October 3, 2019
in Internet Privacy
Just a GIF Image Could Have Hacked Your Android Phone Using WhatsApp
593
SHARES
3.3k
VIEWS
Share on FacebookShare on Twitter

A picture is worth a thousand words, but a GIF is worth a thousand pictures.

Today, the short looping clips, GIFs are everywhere—on your social media, on your message boards, on your chats, helping users perfectly express their emotions, making people laugh, and reliving a highlight.

You might also like

North Korean Hackers Targeting Defense Firms with ThreatNeedle Malware

Russian Hackers Targeted Ukraine Authorities With Supply-Chain Malware Attack

Chinese Hackers Using Firefox Extension to Spy On Tibetan Organizations

But what if an innocent-looking GIF greeting with Good morning, Happy Birthday, or Merry Christmas message hacks your smartphone?

Well, not a theoretical idea anymore.

WhatsApp has recently patched a critical security vulnerability in its app for Android, which remained unpatched for at least 3 months after being discovered, and if exploited, could have allowed remote hackers to compromise Android devices and potentially steal files and chat messages.

WhatsApp Remote Code Execution Vulnerability

The vulnerability, tracked as CVE-2019-11932, is a double-free memory corruption bug that doesn’t actually reside in the WhatsApp code itself, but in an open-source GIF image parsing library that WhatsApp uses.

hacking whatsapp account

Discovered by Vietnamese security researcher Pham Hong Nhat in May this year, the issue successfully leads to remote code execution attacks, enabling attackers to execute arbitrary code on targeted devices in the context of WhatsApp with the permissions the app has on the device.

“The payload is executed under WhatsApp context. Therefore it has the permission to read the SDCard and access the WhatsApp message database,” the researcher told The Hacker News in an email interview.

“Malicious code will have all the permissions that WhatsApp has, including recording audio, accessing the camera, accessing the file system, as well as WhatsApp’s sandbox storage that includes protected chat database and so on…”

How Does WhatsApp RCE Vulnerability Work?

WhatsApp uses the parsing library in question to generate a preview for GIF files when users open their device gallery before sending any media file to their friends or family.

Thus, to be noted, the vulnerability does not get triggered by sending a malicious GIF file to a victim; instead it gets executed when the victim itself simply opens the WhatsApp Gallery Picker while trying to send any media file to someone.

To exploit this issue, all an attacker needs to do is send a specially crafted malicious GIF file to a targeted Android user via any online communication channel and wait for the user to just open the image gallery in WhatsApp.

However, if attackers want to send the GIF file to victims via any messaging platform like WhatsApp or Messenger, they need to send it as a document file rather than media file attachments, because image compression used by these services distorts the malicious payload hidden in images.

Web Application Firewall

As shown in a proof-of-concept video demonstration the researcher shared with The Hacker News, the vulnerability can also be exploited to simply pop-up a reverse shell remotely from the hacked device.

Vulnerable Apps, Devices and Available Patches

The issue affects WhatsApp versions 2.19.230 and older versions running on Android 8.1 and 9.0, but does not work for Android 8.0 and below.

“In the older Android versions, double-free could still be triggered. However, because of the malloc calls by the system after the double-free, the app just crashes before reaching to the point that we could control the PC register,” the researcher writes.

Nhat told The Hacker News that he reported the vulnerability to Facebook, who owns WhatsApp, in late July this year, and the company included a security patch in WhatsApp version 2.19.244, released in September.

Therefore, to protect yourself against any exploit surrounding this vulnerability, you are recommended to update your WhatsApp to the latest version from the Google Play Store as soon as possible.

Besides this, since the flaw resides in an open-source library, it is also possible that any other Android app using the same affected library could also be vulnerable to similar attacks.

The developer of the affected GIF library, called Android GIF Drawable, has also released version 1.2.18 of the software to patch the double-free vulnerability.

WhatsApp for iOS is not affected by this vulnerability.


Credit: The Hacker News By: noreply@blogger.com (Swati Khandelwal)

Previous Post

FTSE 100 Tanks as Trump Points Multi-Billion Tariff Gun at Europe

Next Post

EA to give users a free month of Origin Access if they enable 2FA

Related Posts

North Korean Hackers Targeting Defense Firms with ThreatNeedle Malware
Internet Privacy

North Korean Hackers Targeting Defense Firms with ThreatNeedle Malware

February 26, 2021
Russian Hackers Targeted Ukraine Authorities With Supply-Chain Malware Attack
Internet Privacy

Russian Hackers Targeted Ukraine Authorities With Supply-Chain Malware Attack

February 26, 2021
Chinese Hackers Using Firefox Extension to Spy On Tibetan Organizations
Internet Privacy

Chinese Hackers Using Firefox Extension to Spy On Tibetan Organizations

February 25, 2021
The Top Free Tools for Sysadmins in 2021
Internet Privacy

The Top Free Tools for Sysadmins in 2021

February 25, 2021
Everything You Need to Know About Evolving Threat of Ransomware
Internet Privacy

Everything You Need to Know About Evolving Threat of Ransomware

February 25, 2021
Next Post
EA to give users a free month of Origin Access if they enable 2FA

EA to give users a free month of Origin Access if they enable 2FA

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

Recommended

Plasticity in Deep Learning: Dynamic Adaptations for AI Self-Driving Cars

Plasticity in Deep Learning: Dynamic Adaptations for AI Self-Driving Cars

January 6, 2019
Microsoft, Google Use Artificial Intelligence to Fight Hackers

Microsoft, Google Use Artificial Intelligence to Fight Hackers

January 6, 2019

Categories

  • Artificial Intelligence
  • Big Data
  • Blockchain
  • Crypto News
  • Data Science
  • Digital Marketing
  • Internet Privacy
  • Internet Security
  • Learn to Code
  • Machine Learning
  • Marketing Technology
  • Neural Networks
  • Technology Companies

Don't miss it

AI and machine learning to help global battle with cancer
Machine Learning

AI and machine learning to help global battle with cancer

February 26, 2021
Why your diversity and inclusion efforts should include neurodiverse workers
Internet Security

Why your diversity and inclusion efforts should include neurodiverse workers

February 26, 2021
North Korean Hackers Targeting Defense Firms with ThreatNeedle Malware
Internet Privacy

North Korean Hackers Targeting Defense Firms with ThreatNeedle Malware

February 26, 2021
The Beginner Guide for Creating a Multi-Vendor eCommerce Website
Data Science

The Beginner Guide for Creating a Multi-Vendor eCommerce Website

February 26, 2021
How Artificial Intelligence, Machine Learning will further advance Ed-tech sector?
Machine Learning

How Artificial Intelligence, Machine Learning will further advance Ed-tech sector?

February 26, 2021
Attorney-General urged to produce facts on US law enforcement access to COVIDSafe
Internet Security

Attorney-General urged to produce facts on US law enforcement access to COVIDSafe

February 26, 2021
NikolaNews

NikolaNews.com is an online News Portal which aims to share news about blockchain, AI, Big Data, and Data Privacy and more!

What’s New Here?

  • AI and machine learning to help global battle with cancer February 26, 2021
  • Why your diversity and inclusion efforts should include neurodiverse workers February 26, 2021
  • North Korean Hackers Targeting Defense Firms with ThreatNeedle Malware February 26, 2021
  • The Beginner Guide for Creating a Multi-Vendor eCommerce Website February 26, 2021

Subscribe to get more!

© 2019 NikolaNews.com - Global Tech Updates

No Result
View All Result
  • AI Development
    • Artificial Intelligence
    • Machine Learning
    • Neural Networks
    • Learn to Code
  • Data
    • Blockchain
    • Big Data
    • Data Science
  • IT Security
    • Internet Privacy
    • Internet Security
  • Marketing
    • Digital Marketing
    • Marketing Technology
  • Technology Companies
  • Crypto News

© 2019 NikolaNews.com - Global Tech Updates