4 ms·

WhatsApp Security Vulnerability

• mercora 11y ago
  I wonder why this should only be exploitable on the WhatsApp web application. If it is possible to trick browsers into launching arbitrary applications by using vcards, this should affect many web application using vcards and the the security issue would have been in the browser side of things. What am i missing?
  • mercora 11y ago
    Ok the linked[0] blog post from Check Point has more details into whats actually happening. [0] http://blog.checkpoint.com/2015/09/08/whatsapp-maliciouscard-vulnerabilities-allowed-attackers-to-compromise-hundreds-of-millions-of-whatsapp-users/ http://blog.checkpoint.com/2015/09/08/whatsapp-maliciouscard...
  • steve19 11y ago
    It simply allows you to send arbitrary files. No different to sending a link to a virus over email or putting a link on a Web page. Stupid/normal users would then try run the downloaded file.
    • NullCharacter 11y ago
      It's a little more guileful than that, and it definitely is a flaw with WhatsApp not validating their file types/formats.
      • sambe 11y ago
        But only a little - you could argue the vast majority of e-mail attachments are .doc etc with parsing bugs rather than straight .exe. Contrary to the gushing "using only their phone number" in the article, they admit that gullibility is required.