SECURITY
SECURITY
SECURITY
Update now: WhatsApp bug allows malicious GIF to steal user data
A newly discovered vulnerability in popular Facebook Inc.-owned messaging service WhatsApp allows an attacker to obtain access and steal data by doing nothing more than sending a malicious GIF to a user.
The vulnerability was discovered and publicized Wednesday by a security researcher who goes by the name of Awakened on GitHub. Described as a “double-free bug,” it causes the same memory address on a device to be called twice, causing the memory allocation within the app to open the vulnerability.
The technical specifications behind the exploit are complicated, but exploiting it is not. A malicious GIF file is initially sent to a user. When the user opens the WhatsApp gallery to send an image with any other message, the malicious GIF triggers the bug. It then opens a remote shell in the app, making the device and its contents open to exploitation.
The vulnerability, officially called CVE-2019-11932, is found on all versions of WhatsApp until 2.19.230. Later releases, including 2.19.244, having the vulnerability patched. The exploit only works on Android 8.1 and 9.0 and does not work on Android 8.0 or lower. In the event a device is running Android 8.0 or lower, a malicious GIF attempting to access the vulnerability causes WhatsApp to crash instead.
Users are naturally being encouraged to make sure they are running the latest version of WhatsApp to avoid exposing themselves to the vulnerability.
Ashlee Benge, threat researcher at cybersecurity firm ZeroFOX Inc., told SiliconANGLE that messaging applications have begun to download media files automatically prior to user interaction to enhance the user experience.
“Unfortunately, this does also increase user risk,” Benge explained. “In addition to cases such as this, where a malicious GIF is downloaded without user consent, we often see hyperlink previews (popular on social media sites and messaging applications) abused to load malicious content.”
She said it’s also very important that users recognize that despite advertising, “secure” instant messaging is probably not all that secure. “Although these types of vulnerabilities are generally patched as soon as they are discovered, it is important to be cognizant that secure messaging is not foolproof,” she said.
Photo: Christoph Scholz/Flickr
A message from John Furrier, co-founder of SiliconANGLE:
Support our mission to keep content open and free by engaging with theCUBE community. Join theCUBE’s Alumni Trust Network, where technology leaders connect, share intelligence and create opportunities.
- 15M+ viewers of theCUBE videos, powering conversations across AI, cloud, cybersecurity and more
- 11.4k+ theCUBE alumni — Connect with more than 11,400 tech and business leaders shaping the future through a unique trusted-based network.
About SiliconANGLE Media
SiliconANGLE Media is a recognized leader in digital media innovation, uniting breakthrough technology, strategic insights and real-time audience engagement. As the parent company of SiliconANGLE, theCUBE Network, theCUBE Research, CUBE365, theCUBE AI and theCUBE SuperStudios — with flagship locations in Silicon Valley and the New York Stock Exchange — SiliconANGLE Media operates at the intersection of media, technology and AI.
Founded by tech visionaries John Furrier and Dave Vellante, SiliconANGLE Media has built a dynamic ecosystem of industry-leading digital media brands that reach 15+ million elite tech professionals. Our new proprietary theCUBE AI Video Cloud is breaking ground in audience interaction, leveraging theCUBEai.com neural network to help technology companies make data-driven decisions and stay at the forefront of industry conversations.
