WhatsApp security bug enabled hackers to take over phones with video call

Rene Millman Read more October 11, 2018

The Facebook-owned messaging service, WhatsApp was found to have had a huge security vulnerability in its video calls.

WhatsApp security bug enabled hackers to take over phones with video call

According to Natalie Silvanovich, a digital forensics expert at Google Project Zero, WhatsApp’s video calls provided hackers with the opportunity to take control of a user’s smartphone. The vulnerability arose due to a “memory corruption bug in WhatsApp’s non-WebRTC video conferencing implementation”, she explained in a tweet.

“Heap corruption can occur when the WhatsApp mobile application receives a malformed RTP [Real-time Transport Protocol] packet,” Silvanovich said in a vulnerability report. “This issue can occur when a WhatsApp user accepts a call from a malicious peer.”

Essentially, hackers using this method could hijack a victim’s phone if they simply answered a call, with the potential of remotely accessing a device’s contents and WhatsApp conversations.

The vulnerability was found this August and affected both iPhone and Android versions of the app, but not the desktop version. According to the report, WhatsApp fixed the issue on September 28 in the Android client and on October 3 in the iPhone client.

In a statement to Reuters, WhatsApp said: “We routinely engage with security researchers from around the world to ensure WhatsApp remains safe and reliable. We promptly issued a fix to the latest version of WhatsApp to resolve this issue.” The report added that WhatsApp had “no evidence that hackers actually exploited the bug to launch attacks”.

However, in a tweet, Google Project Zero researcher, Tavis Ormandy, described the issue as a “big deal”.

“Just answering a call from an attacker could completely compromise WhatsApp,” he said. This means that an attacker would only need a phone number to hijack an account and eavesdrop on conversations.

However, Paul Bischoff, privacy advocate at Comparitech, told IT Pro that he was sceptical of the claim that this attack could allow a hacker to remotely take over the victim’s device and access their conversations.

“The proof of concept describes a memory heap overflow that causes the app to crash due to memory corruption but does not indicate that it would allow remote hijacking,” he said. “How could a hacker take over an app if it’s just crashed?”

“That being said, WhatsApp has already patched the vulnerability, so users should be sure to update the app to prevent it from happening.”