WhatsApp, the world’s most popular end-to-end encrypted messaging application, patched an incredibly frustrating software bug that could have allowed a malicious group member to crash the messaging app for all members of the same group, The Hacker News learned.
Just by sending a maliciously crafted message to a targeted group, an attacker can trigger a fully-destructive WhatsApp crash-loop, forcing all group members to completely uninstall the app, reinstall it, and remove the group to regain normal function.
Since the group members can’t selectively delete the malicious message without opening the group window and re-triggering the crash-loop, they have to lose the entire group chat history, indefinitely, to get rid of it.
Discovered by researchers at Israeli cybersecurity firm Check Point, the latest bug resided in the WhatsApp’s implementation of XMPP communication protocol that crashes the app when a member with invalid phone number drops a message in the group.
To be noted, the issue resided in both, WhatsApp for Android and iOS, but in an interview with The Hacker News, Check Point researcher Roman Zaikin confirmed that the exploit works smoothly against all vulnerable Android users, but sometimes doesn’t reproduce on iOS.
The attack requires a malicious group member to manipulate other parameters associated with messages in a conversation that is otherwise protected using end-to-end encryption.
In order to carry out this attack, an attacker can leverage WhatsApp Web and a web browser debugging tool in combination with an open source WhatsApp manipulation tool that Check Point released last year.
The WhatsApp manipulation tool is an extension for Burp Suite penetration testing software that allows users to intercept, decrypt, and re-encrypt their WhatsApp communication using their own encryption keys.
As shown in the video demonstration, the researchers used this setup to trigger the crash bug against all members of a group by simply replacing the participant’s parameter from the sender’s phone number to ‘[email protected],’ an invalid non-digit phone number.
It should be noted that the attack would not affect the sender since the malicious message was injected in transit after it left the sender’s device.
Check Point responsibly reported this crash bug to the WhatsApp security team back in late August this year, and the company patched the issue with the release of WhatsApp version 2.19.58 in mid-September.
The WhatsApp developers also “added new controls to prevent people from being added to unwanted groups to avoid communication with untrusted parties altogether.”
WhatsApp users are highly recommended to always keep their apps up-to-date in order to protect themselves against known attacks.