A bug allowed hacking WhatsApp and Telegram accounts with an image

[OyaYansa]

A team of researchers at security firm Check Point has revealed a vulnerability that allowed hacking of WhatsApp and Telegram accounts in a simple way: by sending a malicious image. According to the report, with this strategy attackers could take complete control of victim profiles, with access to contacts, conversations, and shared photos and videos.

From Check Point they explain that the bug could be exploited through the browser version of WhatsApp and Telegram. The web application of both platforms is synchronized with the user's device and contains a mirror of all the messages sent and received by the users, so that the security gap allowed the attacker to have free access to all the contents of the account.

According to the researchers, to take advantage of this security bug all you had to do was send a seemingly normal image with malicious code injected. In the case of WhatsApp, when the victim clicked on the photo to open it, the code that was executed allowed the attacker to enter the local storage, where the user's data is located. In Telegram it was necessary to click again to open a new browser tab and give access to local storage.

From this moment, the cybercriminals could view and download all the contents, as well as control the account at will. In this way, he could repeat the attack with the contacts of the victim by mass sending the malicious image. In addition, because the messages are encrypted end-to-end, companies are not aware of the files being sent, which prevents them from detecting malware.

Check Point informed WhatsApp and Telegram of the vulnerability on March 7. It ensures that both instant messaging platforms tested and recognized the security issue, developing a solution for web clients that fixed the bug.

Telegram denies having been affected by the vulnerability
Following the release of the news in the media around the world, Telegram has issued a statement to deny that this vulnerability has existed. According to the company, Check Point reported that Telegram had the same problem as WhatsApp to maximize its impact on the press, and assures that in the case of its platform the security of the account has not been compromised at any time by the described technique .