Vulnerability in WhatsApp for Android allows others to read your conversations

By Williams Pelegrin March 12, 2014

whatsapp offline message facebook feature — Image used with permission by copyright holder

If you’re chatting in WhatsApp, you may not want to say anything too private. Double Think chief technology officer Bas Bosschert has discovered a glaring security flaw sure to put frowns on plenty of people’s faces.

Here’s what’s wrong: When you back up your WhatsApp data, possibly because you want to install the app on another device, the back-up goes to the WhatsApp database, which is saved on your phone’s SD card. Rather than make a unique code for each user, WhatsApp uses the same encryption code for everyone. This spells bad news for users since, in theory, a developer can make an app that can decrypt and gain access to that data. So long as you grant the app the permissions it asks for, your messages will be exposed in all their glory and possibly uploaded to third-parties.

Bosschert tested the theory by developing a companion app, and used a loading screen while the app acquired the database files and uploaded them. Unfortunately, the app succeeded in doing so, with Bosschert reporting that, even with yesterday’s WhatsApp for Android update, the security flaw still exists.

For reference, the iOS version of the app does the same thing, but Apple prevents access to the sandbox WhatsApp creates when storing data.

We have no idea when or if a fix is coming. Until then, chat casual.

Editors' Recommendations

Topics

Williams Pelegrin

Former Digital Trends Contributor

Williams is an avid New York Yankees fan, speaks Spanish, resides in Colorado, and has an affinity for Frosted Flakes. Send…

Mobile

Google is launching a powerful new AI app for your Android phone

Google Gemini app on Android.

Remember Bard, Google’s answer to ChatGPT? Well, it is now officially called Gemini. Also, all those fancy AI features that previously went by the name Duet AI have been folded under the Gemini branding. In case you haven’t been following up all the AI development flood, the name is derived from the multi-modal large language model of the same name.

To go with the renaming efforts, Google has launched a standalone Gemini app on Android. Moreover, the Gemini experience is also being made available to iPhone users within the Google app on iOS. But wait, there’s more.

Mobile

If you have one of these apps on your Android phone, delete it immediately

The app drawer on the Google Pixel 8 Pro.

The NSO Group raised security alarms this week, and once again, it’s the devastatingly powerful Pegasus malware that was deployed in Jordan to spy on journalists and activists. While that’s a high-profile case that entailed Apple filing a lawsuit against NSO Group, there’s a whole world of seemingly innocuous Android apps that are harvesting sensitive data from an average person’s phone.
The security experts at ESET have spotted at least 12 Android apps, most of which are disguised as chat apps, that actually plant a Trojan on the phone and then steal details such as call logs and messages, remotely gain control of the camera, and even extract chat details from end-to-end encrypted platforms such as WhatsApp.
The apps in question are YohooTalk, TikTalk, Privee Talk, MeetMe, Nidus, GlowChat, Let’s Chat, Quick Chat, Rafaqat, Chit Chat, Hello Chat, and Wave Chat. Needless to say, if you have any of these apps installed on your devices, delete them immediately.
Notably, six of these apps were available on the Google Play Store, raising the risk stakes as users flock here, putting their faith in the security protocols put in place by Google. A remote access trojan (RAT) named Vajra Spy is at the center of these app's espionage activities.

A chat app doing serious damage

Mobile

How to force close apps on your Android device

The app drawer on the Google Pixel 8 Pro.

Smartphone apps are great. They're quick to load, and generally well optimized. But have you ever noticed that they tend to get faster at loading after you've used them a bit? That's not your mind playing tricks on you; it's because your Android smartphone doesn't tend to close apps even when you're done with them. Instead, it keeps them tucked away in its memory. This makes going back to apps faster, and if it becomes a memory hog, Android generally knows how to fix that.