Cybersecurity researchers at Check Point Software Technologies Ltd. have uncovered disturbing vulnerabilities in the Facebook Inc.-owned WhatsApp that allow malicious actors to intercept and manipulate group and individual messages.

The vulnerabilities, all of which involve social engineering tactics to fool users, can allow an attacker to alter the text of someone else’s reply. They also allow hackers to use the “quote” feature in a group conversation to change the identity of the sender, even if that person is not a member of the group. And they can send a private message to another group participant that is disguised as a public message for all, so when the targeted individual responds, it’s visible to everyone in the conversation.

Digging into the technical analysis, this isn’t a method that most people could easily tap into. WhatsApp messages are encrypted by default, but the problem lies in the ability to intercept the decryption key between parties who are participating in a group chat.

“The keys can be obtained from the key generation phase from WhatsApp Web before the QR code is generated,” the researchers explained. Following a number of other steps, they explain that “by decrypting the WhatsApp communication, we were able to see all the parameters that are actually sent between the mobile version of WhatsApp and the Web version. This allowed us to then be able to manipulate them and start looking for security issues.”

WhatsApp responded to the news, saying that “we carefully reviewed this issue and it’s the equivalent of altering an email to make it look like something a person never wrote.” It added that “the claim has nothing to do with the security of end-to-end encryption, which ensures only the sender and recipient can read messages sent on WhatsApp.”

The story comes at a time when WhatsApp is in the news as users in India and Bangladesh have been using the app to spread rumors and fake news that have resulted in rioting and in some cases actual lynching.

Photo: 140988606@N08/Flickr