Name: New Warning For WhatsApp Users Over Account Suspension ‘Hack’
Brand: forbes.com
SKU: forbes-com-258
Availability: OnlineOnly

critic

New Warning For WhatsApp Users Over Account Suspension ‘Hack’

preview

BETAThis is a BETA experience. You may opt-out by&nbsp;Apr 10, 2021,A nasty new surprise for WhatsApp’s 2 billion users today, with the discovery of an alarming security risk. Using just your phone number, a remote attacker can easily deactivate WhatsApp on your phone and then stop you getting back in. Even two-factor authentication will not stop this. Here’s how the attack works.This shouldn't happen. It shouldn't be possible. Not with a platform used by 2 billion people. Not this easily. When researchers,MORE FROMNow, let’s start with the first weakness. Anyone can install WhatsApp on a phone and enter yourAn attacker can be doing this with your WhatsApp phone number while you continue to use your app as normal. TheyThe issue is that WhatsApp’s verification process limits the number of codes that can be sent. After a few attempts, the attacker’s WhatsApp will say: “Resend SMS/Call me in 12 hours,” and so no new codes can be generated. WhatsApp also blocks code entries on the app after a number of attempts as well, telling the attacker “you have guessed too many times... try again in 12 hours.”And so, while WhatsApp on yourNone of this should be a problem for you. Unless you deactivate WhatsApp on your phone and need to reverify, there isn’t an issue. And so, to weakness number two.The attacker now registers a new, fresh email address, Gmail will do, and sends an email to support@whatsapp.com. Lost/stolen account, the email, says, please deactivate my number. The attacker includes your number. WhatsApp might send an automatic email reply asking for the number again, the attacker complies.So, to be very clear. WhatsApp has received an email referencing your phone number. They have no way of knowing whether this is really from you. There are no follow-up questions to confirm your ownership of the number. But an automated process has been triggered, without your knowledge, and your account will now be deactivated.An hour or so later, and suddenly WhatsApp stops working on yourThis happens even if you have 2FA on your WhatsApp account. But, even so, this still shouldn't be a problem. You just need to request a code and reregister your account.Your deactivated WhatsApp asks for your phone number to send you a code. You enter and confirm your number. But no text arrives. “You’ve tried to register [your numberWait, whatBut suddenly you remember that you received unexpected WhatsApp codes an hour or two earlier. You retrieve the most recent SMS and enter the code into WhatsApp. But even this will not work. “You have guessed too many times,” your WhatsApp tells you. Obviously, youThe countdown likely reads 10 to 11 hours at this point. If the attack stops here, you will be able to request a new SMS and verify your account using a new six-digit code after that 12-hour timer has expired. But there’s a nasty twist.The attacker does not need to email WhatsApp during that first 12-hour countdown, instead they can wait and then repeat the process. You will receive lots more texts, but there’s still nothing you can do with them, albeit you’ll suspect something is wrong.If the attacker does this, then on the third 12-hour cycle, WhatsApp appears to break down. “You have guessed too many times,” their app will say, “try again after -1 seconds.” There is now no way for the attacker to request or enter new codes, there is no countdown, instead of saying “12 hours” it says “-1 seconds.” It has stalled.But unfortunately, yourEven if the attacker deactivates your phone during the first cycle, they can push you into a second 12-hour countdown if they request and enter codes at the expiration of the first countdown before you get chance. Remember, they see the same timer as you.Clearly, the combination of this verification architecture, the SMS/code limits and the automated, keyword-based actions triggered by incoming emails is open to abuse. There is no sophistication to this attack—that’s the real issue here and WhatsApp should address it immediately. There are many reasons why it might be advantageous to block someone from their go-to messenger. It shouldn’t be this easy. And this should notThis isn’t complex and should be easily fixed. WhatsApp could ensure that an app on a device with 2FA registered can prevent this issue, using 2FA as a circuit breaker. Even more simply, when multi-device access eventually appears, WhatsApp could use the trusted device concept to enable one verified app to verify another. This is a much better system and would shut down this vulnerability.According to Moore, this vulnerability has flagged another serious WhatsApp issue. “There is no way of opting out of being discovered on WhatsApp,” he warns. “Anyone can type in a phone number to locate the associated account if it exists. Ideally, a move towards being more privacy focused would help protect users from this, as well as forcing people to implement a two-step verification PIN.”Ironically, this problem comes about given secure messaging being linked only to a phone number, operating “over the top,” with no back-end links to a device’s OS or number. Logic suggests that the app couldIn response to the disclosure, a WhatsApp spokesperson told me that “providing an email address with your two-step verification helps our customer service team assist people should they ever encounter this unlikely problem. The circumstances identified by this researcher would violate our terms of service and we encourage anyone who needs help to email our support team so we can investigate.”What they mean is that if you were to carry out this attack, you would be in violation of their terms of service and would face consequences. That doesn’t help any victims but should serve as a warning not to experiment with this vulnerability.WhatsApp would not confirm that it plans to fix this vulnerability, despite the fact that it can be easily and anonymously exploited. Their response was to play down the risk—but that risk is very real. Beyond the nuisance factor, there are material advantages in taking someone “off comms.” So, given the widespread use of WhatsApp, this is a security gap that needs plugging. An attacker doesn’t even need a phone number to spoof a new install, a device connected over Wifi will work just fine.Unfortunately, playing down the seriousness of security risks has become the in-house style at Facebook. Back in 2019, IOf course, your other option would be to follow Mark Zuckerberg’s reported example and start to use Signal. The privacy-first messenger is the most viable alternative to WhatsApp and is ironically part funded by WhatsApp co-founder Brian Acton.I remain hopeful that WhatsApp will change its stance and will fix this vulnerability—I will update this story if and when that happens.—-Update, April 13:After this article was published, Tsachi Ganot, CEO of Israeli security firm Pandora Security, contacted me to say that this is not the first time that the core verification vulnerability has been pointed out to Facebook and WhatsApp.Back in December, Ganot’s team exploited the security weakness a different way, reporting a user’s phone as lost before blocking the verification process. Ganot’s findings were in Israel at the time, and they believe that the vulnerability has been exploited in the wild to disconnect user accounts.This meant an attack would have to take place while the victim was not accessing their phone, perhaps overnight, making the 12-hour countdown more critical, as the victim would be able to enter a code. But the core issue is the same.“We researched this issue back in December,” Ganot told me this week, “after a few clients reported they were suddenly disconnected from their accounts. Once we realized how severe and easy this attack was to carry out, we reached out to Facebook and were totally ignored, so we wrote about it. Reading that nothing has changed is unfortunate but not very surprising.”Now we know that with a new twist this attack can work even when a victim has their phone and can see incoming verification messages, rendering the 12-hour countdown irrelevant. We also now know that pushing the phone into three cycles will crash the 12-hour countdown process and block the phone completely.And so it appears that Facebook was aware of this issue before I reported the new research to them on 25 March. The fact that this vulnerability remains in place and there has been no confirmation that a fix is under development is a real concern. One would hope that all the media coverage this week will now encourage Facebook/WhatsApp to address this.&nbsp;or&nbsp;.&nbsp;

BETAThis is a BETA experience. You may opt-out by&nbsp;Apr 10, 2021,A nasty new surprise for WhatsApp’s 2 billion users today, with the discovery of an alarming security risk. Using just your phone number, a remote attacker can easily deactivate WhatsApp on your phone and then stop you getting back in. Even two-factor authentication will not stop this. Here’s how the attack works.This shouldn't happen. It shouldn't be possible. Not with a platform used by 2 billion people. Not this easily. When researchers,MORE FROMNow, let’s start with the first weakness. Anyone can install WhatsApp on a...

public

Zak Doffman

Official account of Forbes, the world’s leading voice for entrepreneurial success and free enterprise, and home to breaking news, business, money and more.

New Warning For WhatsApp Users Over Account Suspension ‘Hack’

No article scores yet.

CRITIC REVIEWS

PUBLIC REVIEWS