7 ms·

Vulnerability That Allowed Hackers to Take Over WhatsApp and Telegram Accounts

92 points by tzury 10y ago

apeace 10y ago
Interesting that this post references the CIA Wikileaks publication, but does not explicitly say that the exploit was found via those leaks. It would be very big news if that were the case. Major news outlets such as the New York Times[0] have slammed Wikileaks for using "misleading" language to describe the leaks, specifically in reference to WhatsApp. I hope the author will clarify how they came across this exploit. From the NYT article: > In their haste to post articles about the release, almost all the leading news organizations took the WikiLeaks tweets at face value. Their initial accounts mentioned Signal, WhatsApp and other encrypted apps by name, and described them as “bypassed” or otherwise compromised by the C.I.A.’s cyberspying tools. > Yet on closer inspection, this turned out to be misleading. Neither Signal nor WhatsApp, for example, appears by name in any of the alleged C.I.A. files in the cache. [0] https://www.nytimes.com/2017/03/09/opinion/the-truth-about-the-wikileaks-cia-cache.html https://www.nytimes.com/2017/03/09/opinion/the-truth-about-t...
- ryanlol 10y ago
  >I hope the author will clarify how they came across this exploit. These bugs didn't come from wikileaks. >Major news outlets such as the New York Times[0] have slammed Wikileaks for using "misleading" language to describe the leaks, specifically in reference to WhatsApp. Still wouldn't explain their claims about Signal.
passivepinetree 10y ago
Can someone more involved with security than me describe what the authors mean when they say files will now be "validated" by WhatsApp and Telegram before being sent?
- tokenizerrr 10y ago
  The post describes that the client ensured only files with specific mimetypes could be uploaded. However, patching the client allowed files to be uploaded while that shouldn't have been allowed. Most likely they mean the whatsapp server now also checks the mimetype of uploaded files, rejecting those that aren't ok.
- dsacco 10y ago
  In very basic terms it means that some level of sophisticated file type and content-type verification will be performed in a manner that is theoretically secure. For example, Whatsapp shouldn't have allowed HTML to be uploaded if it's disguised as an image thumbnail. That's pulling a page right out of 2002. This is very easy to do 80% of the way, and difficult to do with the remaining 20%. The last mile of file validation is extremely fickle because it requires an understanding of what the uploading library is doing under the hood. You can minimize your risk by carefully choosing files to accept, understanding how they're parsed by your libraries and correctly disallowing everything else. Practically speaking, you should at a minimum: 1. Whitelist acceptable file types, 2. Perform server-side, not client-side validation, 3. Validate the file types not only by extension, but by contents, 4. Disallow filenames from being set by user input, and ideally hash them before presenting them back, 5. Store the files on a separate host/CDN, 6. Only allow the uploader to retrieve files uploaded by the user, and not from local or remote resources. If you must allow local directories, maintain strict permissions, and do not allow loopback resources. That's a great start. To go further, you should investigate which library to use carefully and consider how legitimate files you are choosing to whitelist can still be dangerous. For example, you can trigger an XSS with a valid SVG. You can attack system memory with fraudulent JPG sizes. You can trigger server-side request forgery by uploading 127.0.0.1, etc.
  - ploggingdev 10y ago
    > 2. Perform server-side, not client-side validation, WhatsApp is end to end encrypted, so how is server side validation possible?
    - dsacco 10y ago
      It's not :) I was being prescriptive about general purpose applications, sorry! In this specific scenario, the files should be validated before a user is presented with them and after they are received and decrypted. The client-side validation is only so that the attacker cannot bypass it and leave the server vulnerable; you can instead offload this to the other party, which in this case is client 2 in a client <-> client communication rather than client <-> server communication. The point is that it happens somewhere out of an attacker's control in a trusted environment. Obviously, the same limitation applies to server-side validation, which is that the file must be validated without triggering a latent exploit within it. That's why it's also important to understand the parsing libraries.
tedunangst 10y ago
This is only if you use the web client? The article almost goes out of its way to implicate mobile clients, but my understanding is they're not affected?
- lucb1e 10y ago
  That is my understanding as well. It's written like a media prop -- I mean, look at this: > bypass Telegram’s upload policy and upload a malicious HTML document with a mime type of a video file “video/mp4”. Then, they were able to send it to the victim side in an encrypted channel through telegram servers. It's only missing the words "cyber" and "darknet" to make it complete, but they just upload html with javascript (malicious or not) and it happens to be over https. So it's a bit obfuscated, but yeah it seems to only affect the web clients.
lucb1e 10y ago
So basically, you can upload HTML and have users of the web client run the code on the Telgram/Whatsapp domain by sending it with another MIME type such as mp4? I use Telegram Desktop but this should have showed up in any security test, which they apparently didn't do. As a pen tester, maybe I should take it upon myself to audit stuff that I use now and then...
- bsamuels 10y ago
  it's very easy to say "wow they should have tested for that" in retrospect with any vulnerability
  - lucb1e 10y ago
    Definitely, which is why I said: any security audit would have found this, so I'm guessing they never had any.
- morsch 10y ago
  For What'sApp the attack is apparently even more simple. IIUC, there is a client-side whitelist of MIME types on uploader's side. Obviously, the attacker can change the code on their side to whatever they want; in this case they just add text/html to the whitelist. Apparently, the receiving end just uses the browser to render whatever it's being sent. So apparently there is (or was) effectively no whitelist or verification on the receiving end. Conveniently, the uploader can also control metadata including filename and the thumbnail. Since the payload is e2e encrypted (for What'sApp, anyway), the server obviously has no idea that any of this is going.
old_parr 10y ago
http://telegra.ph/Checkpoint-Confusion-NEWS http://telegra.ph/Checkpoint-Confusion-NEWS
idlewords 10y ago
This applies to the web versions of these apps. While this is painful advice, if you need the security protections of WhatsApp or Signal, don't use those apps on the desktop. The web/desktop versions are only as secure as the OS and browser underneath them. Instead, use them on a late-model iPhone or iPad (with a bluetooth keyboard if screen keyboards drive you nuts). Don't use Telegram at all.
- ryanisnan 10y ago
  > Don't use Telegram at all. Care to elaborate on that?
  - idlewords 10y ago
    Telegram uses a custom protocol that makes professional cryptographers like Matthew Green tweet things like this: https://twitter.com/matthew_d_green/status/726428912968982529?lang=en https://twitter.com/matthew_d_green/status/72642891296898252... WhatsApp and Signal use the Signal protocol, which has a good reputation among working cryptographers (who I hope we'll hear from in this thread).
    - ReverseCold 10y ago
      It's the only thing my friends will use because they're scared of encryption. Telegram doesn't have encryption. Still waiting for something with native apps for all platforms to be reasonably trustless and have all the goodies that TG has (bots, games, etc).
    - elastic_church 10y ago
      > And oh boy, does Telegram encryption suck. Seriously people, don't use that except on a dare.
    - unicornporn 10y ago
      The greatest problem with the Telegram encryption is that nobody I know uses it. Why? 1. It's not default. 2. Encrypted chats don't sync between devices.
deleted 10y ago
[deleted]
strictnein 10y ago
When you boil it down, these are both just moderately complex stored XSS attacks, right? Construct a weird video or image, get it stored on the Telegram/WhatsApp servers, and if the user is using the web interface, they could trigger the malicious code by clicking on the image or opening the video in a new tab.
- misterrobot 10y ago
  Yeah, this is literally just stored XSS. The fact that they don't even mention XSS in the article just amplifies its click-baitiness.
misterrobot 10y ago
LOL, these are literally just XSS attacks, the sky is not falling. This is such clickbait. Posts like this make the security community look bad IMO. Report it and move on.
- irundebian 10y ago
  OLOL LITERALLY!?! What's your problem dude? A single XSS vulnerability can have severe impacts up to a compromise of a system when sensitive data from authorized users are stolen.
  - misterrobot 10y ago
    XSS is the most common bug on the internet, and there is nothing interesting or novel about this that warrants an article in my opinion. My problem is that this article makes people scared in a way that I do not think is productive. Kudos to whoever found the bug for finding it and making everyone safer, but I thought the article was needlessly clickbaitey. I agree I should probably be less cavalier-sounding though, sorry.
    - irundebian 10y ago
      No offense. The widespread of XSS makes it not less harmful. Although attacks with XSS vulnerabilities requires further actions by the attacked users, these are often easily provoked. IMHO a vulnerability shouldn't be rated by its trivialness but by its impact. Still I think checkpoint is doing clickbaiting, regarding to their description of the vulnerability and Telegrams reply.
mimeezo 10y ago
And here is @tptacek the Knight to run and defend Signal and moxie. Well played sir, well played.
- irundebian 10y ago
  I still assume Signal is the most secure public messenger which has more than several thousands of users. Still I have the feeling, Signal behaves kinda broken and immature. The phone functionality never worked properly for me. Sometimes I'm receiving message/encryption errors. Also sometimes having delay issues.
homakov 10y ago
Statement from @durov - http://telegra.ph/Checkpoint-Confusion-NEWS?1 http://telegra.ph/Checkpoint-Confusion-NEWS?1 Because both are Web versions, I'd rate Whatsapp one as 6/10 severity and (due to how hard it is to trick the user) Telegram as 3/10. Don't have stats but given how inconvenient Web versions are, I don't think they are widely used.
- zulln 10y ago
  I would say more people use WhatsApp Web than Telegram (percent, not absolute numbers). Telegram does have a desktop client, while WhatsApp Web is the only choice if you want to reply to something from your desktop (taken third-parties aside).
  - homakov 10y ago
    Then, I'd up it to 8/10! I use Telegram for macOS, it's much nicer.
  - donatzsky 10y ago
    WhatsApp does actually have a desktop client. It's nothing spectacular, but works well enough.
- mkagenius 10y ago
  > Statement from @durov - http://telegra.ph/Checkpoint-Confusion-NEWS?1 http://telegra.ph/Checkpoint-Confusion-NEWS?1 How is it that the explanation from companies come only after the researchers writes a blog? Why can't they disclose the bug themselves (if it had been fixed).
  - homakov 10y ago
    In Telegram case, the bug is really a minor severity. Unpopular client, hard to phish scenario. It's only in checkmark's interest to overhype the issue.
    - mkagenius 10y ago

92 points by tzury 10y ago

Interesting that this post references the CIA Wikileaks publication, but does not explicitly say that the exploit was found via those leaks. It would be very big news if that were the case. Major news outlets such as the New York Times[0] have slammed Wikileaks for using "misleading" language to describe the leaks, specifically in reference to WhatsApp. I hope the author will clarify how they came across this exploit. From the NYT article: > In their haste to post articles about the release, almost all the leading news organizations took the WikiLeaks tweets at face value. Their initial accounts mentioned Signal, WhatsApp and other encrypted apps by name, and described them as “bypassed” or otherwise compromised by the C.I.A.’s cyberspying tools. > Yet on closer inspection, this turned out to be misleading. Neither Signal nor WhatsApp, for example, appears by name in any of the alleged C.I.A. files in the cache. [0] https://www.nytimes.com/2017/03/09/opinion/the-truth-about-the-wikileaks-cia-cache.html https://www.nytimes.com/2017/03/09/opinion/the-truth-about-t...

ryanlol 10y ago
>I hope the author will clarify how they came across this exploit. These bugs didn't come from wikileaks. >Major news outlets such as the New York Times[0] have slammed Wikileaks for using "misleading" language to describe the leaks, specifically in reference to WhatsApp. Still wouldn't explain their claims about Signal.

passivepinetree 10y ago

Can someone more involved with security than me describe what the authors mean when they say files will now be "validated" by WhatsApp and Telegram before being sent?

tokenizerrr 10y ago
The post describes that the client ensured only files with specific mimetypes could be uploaded. However, patching the client allowed files to be uploaded while that shouldn't have been allowed. Most likely they mean the whatsapp server now also checks the mimetype of uploaded files, rejecting those that aren't ok.
dsacco 10y ago
In very basic terms it means that some level of sophisticated file type and content-type verification will be performed in a manner that is theoretically secure. For example, Whatsapp shouldn't have allowed HTML to be uploaded if it's disguised as an image thumbnail. That's pulling a page right out of 2002. This is very easy to do 80% of the way, and difficult to do with the remaining 20%. The last mile of file validation is extremely fickle because it requires an understanding of what the uploading library is doing under the hood. You can minimize your risk by carefully choosing files to accept, understanding how they're parsed by your libraries and correctly disallowing everything else. Practically speaking, you should at a minimum: 1. Whitelist acceptable file types, 2. Perform server-side, not client-side validation, 3. Validate the file types not only by extension, but by contents, 4. Disallow filenames from being set by user input, and ideally hash them before presenting them back, 5. Store the files on a separate host/CDN, 6. Only allow the uploader to retrieve files uploaded by the user, and not from local or remote resources. If you must allow local directories, maintain strict permissions, and do not allow loopback resources. That's a great start. To go further, you should investigate which library to use carefully and consider how legitimate files you are choosing to whitelist can still be dangerous. For example, you can trigger an XSS with a valid SVG. You can attack system memory with fraudulent JPG sizes. You can trigger server-side request forgery by uploading 127.0.0.1, etc.
- ploggingdev 10y ago
  > 2. Perform server-side, not client-side validation, WhatsApp is end to end encrypted, so how is server side validation possible?
  - dsacco 10y ago
    It's not :) I was being prescriptive about general purpose applications, sorry! In this specific scenario, the files should be validated before a user is presented with them and after they are received and decrypted. The client-side validation is only so that the attacker cannot bypass it and leave the server vulnerable; you can instead offload this to the other party, which in this case is client 2 in a client <-> client communication rather than client <-> server communication. The point is that it happens somewhere out of an attacker's control in a trusted environment. Obviously, the same limitation applies to server-side validation, which is that the file must be validated without triggering a latent exploit within it. That's why it's also important to understand the parsing libraries.

tedunangst 10y ago

This is only if you use the web client? The article almost goes out of its way to implicate mobile clients, but my understanding is they're not affected?

lucb1e 10y ago
That is my understanding as well. It's written like a media prop -- I mean, look at this: > bypass Telegram’s upload policy and upload a malicious HTML document with a mime type of a video file “video/mp4”. Then, they were able to send it to the victim side in an encrypted channel through telegram servers. It's only missing the words "cyber" and "darknet" to make it complete, but they just upload html with javascript (malicious or not) and it happens to be over https. So it's a bit obfuscated, but yeah it seems to only affect the web clients.

lucb1e 10y ago

So basically, you can upload HTML and have users of the web client run the code on the Telgram/Whatsapp domain by sending it with another MIME type such as mp4? I use Telegram Desktop but this should have showed up in any security test, which they apparently didn't do. As a pen tester, maybe I should take it upon myself to audit stuff that I use now and then...

bsamuels 10y ago
it's very easy to say "wow they should have tested for that" in retrospect with any vulnerability
- lucb1e 10y ago
  Definitely, which is why I said: any security audit would have found this, so I'm guessing they never had any.
morsch 10y ago
For What'sApp the attack is apparently even more simple. IIUC, there is a client-side whitelist of MIME types on uploader's side. Obviously, the attacker can change the code on their side to whatever they want; in this case they just add text/html to the whitelist. Apparently, the receiving end just uses the browser to render whatever it's being sent. So apparently there is (or was) effectively no whitelist or verification on the receiving end. Conveniently, the uploader can also control metadata including filename and the thumbnail. Since the payload is e2e encrypted (for What'sApp, anyway), the server obviously has no idea that any of this is going.

old_parr 10y ago

http://telegra.ph/Checkpoint-Confusion-NEWS http://telegra.ph/Checkpoint-Confusion-NEWS

idlewords 10y ago

This applies to the web versions of these apps. While this is painful advice, if you need the security protections of WhatsApp or Signal, don't use those apps on the desktop. The web/desktop versions are only as secure as the OS and browser underneath them. Instead, use them on a late-model iPhone or iPad (with a bluetooth keyboard if screen keyboards drive you nuts). Don't use Telegram at all.

ryanisnan 10y ago
> Don't use Telegram at all. Care to elaborate on that?
- idlewords 10y ago
  Telegram uses a custom protocol that makes professional cryptographers like Matthew Green tweet things like this: https://twitter.com/matthew_d_green/status/726428912968982529?lang=en https://twitter.com/matthew_d_green/status/72642891296898252... WhatsApp and Signal use the Signal protocol, which has a good reputation among working cryptographers (who I hope we'll hear from in this thread).
  - ReverseCold 10y ago
    It's the only thing my friends will use because they're scared of encryption. Telegram doesn't have encryption. Still waiting for something with native apps for all platforms to be reasonably trustless and have all the goodies that TG has (bots, games, etc).
  - elastic_church 10y ago
    > And oh boy, does Telegram encryption suck. Seriously people, don't use that except on a dare.
  - unicornporn 10y ago
    The greatest problem with the Telegram encryption is that nobody I know uses it. Why? 1. It's not default. 2. Encrypted chats don't sync between devices.

deleted 10y ago

[deleted]

strictnein 10y ago

When you boil it down, these are both just moderately complex stored XSS attacks, right? Construct a weird video or image, get it stored on the Telegram/WhatsApp servers, and if the user is using the web interface, they could trigger the malicious code by clicking on the image or opening the video in a new tab.

misterrobot 10y ago
Yeah, this is literally just stored XSS. The fact that they don't even mention XSS in the article just amplifies its click-baitiness.

misterrobot 10y ago

LOL, these are literally just XSS attacks, the sky is not falling. This is such clickbait. Posts like this make the security community look bad IMO. Report it and move on.

irundebian 10y ago
OLOL LITERALLY!?! What's your problem dude? A single XSS vulnerability can have severe impacts up to a compromise of a system when sensitive data from authorized users are stolen.
- misterrobot 10y ago
  XSS is the most common bug on the internet, and there is nothing interesting or novel about this that warrants an article in my opinion. My problem is that this article makes people scared in a way that I do not think is productive. Kudos to whoever found the bug for finding it and making everyone safer, but I thought the article was needlessly clickbaitey. I agree I should probably be less cavalier-sounding though, sorry.
  - irundebian 10y ago
    No offense. The widespread of XSS makes it not less harmful. Although attacks with XSS vulnerabilities requires further actions by the attacked users, these are often easily provoked. IMHO a vulnerability shouldn't be rated by its trivialness but by its impact. Still I think checkpoint is doing clickbaiting, regarding to their description of the vulnerability and Telegrams reply.

mimeezo 10y ago

And here is @tptacek the Knight to run and defend Signal and moxie. Well played sir, well played.

irundebian 10y ago
I still assume Signal is the most secure public messenger which has more than several thousands of users. Still I have the feeling, Signal behaves kinda broken and immature. The phone functionality never worked properly for me. Sometimes I'm receiving message/encryption errors. Also sometimes having delay issues.

homakov 10y ago

Statement from @durov - http://telegra.ph/Checkpoint-Confusion-NEWS?1 http://telegra.ph/Checkpoint-Confusion-NEWS?1 Because both are Web versions, I'd rate Whatsapp one as 6/10 severity and (due to how hard it is to trick the user) Telegram as 3/10. Don't have stats but given how inconvenient Web versions are, I don't think they are widely used.

zulln 10y ago
I would say more people use WhatsApp Web than Telegram (percent, not absolute numbers). Telegram does have a desktop client, while WhatsApp Web is the only choice if you want to reply to something from your desktop (taken third-parties aside).
- homakov 10y ago
  Then, I'd up it to 8/10! I use Telegram for macOS, it's much nicer.
- donatzsky 10y ago
  WhatsApp does actually have a desktop client. It's nothing spectacular, but works well enough.
mkagenius 10y ago
> Statement from @durov - http://telegra.ph/Checkpoint-Confusion-NEWS?1 http://telegra.ph/Checkpoint-Confusion-NEWS?1 How is it that the explanation from companies come only after the researchers writes a blog? Why can't they disclose the bug themselves (if it had been fixed).
- homakov 10y ago
  In Telegram case, the bug is really a minor severity. Unpopular client, hard to phish scenario. It's only in checkmark's interest to overhype the issue.
  - mkagenius 10y ago