Researchers claim WhatsApp group chats vulnerable, company denies

WhatsApp security loophole can add uninvited members to your groups

A group of security researchers from Ruhr University in Germany has revealed a security loophole in the end-to-end encrypted messaging app WhatsApp.

Speaking to Wired, one of the researchers said: "The confidentiality of the group is broken as soon as the uninvited member can obtain all the new messages and read them". According to the German researchers, the power of any WhatsApp group lies in WhatsApp servers and not the group admin.

Responding to the report, WhatsApp said, "We've looked at this issue carefully". "Existing members are notified when new people are added to a WhatsApp group". "WhatsApp is built so group messages can not be send to hidden users and provides multiple ways for users to confirm who receives a message prior to it being sent". The researchers recommend in their paper that summarizes their findings that users who rely on absolute privacy should stick to Signal or individual private messaging. "And if not, the value of encryption is very little", he added.

He adds: "The content of messages sent in WhatsApp groups remain protected by end-to-end encryption". As for Threema, there were smaller flaws that allowed an attacker who controls servers to replay messages or add users back into a group chat. Now WhatsApp is testing a feature, which will allow a particular admin to be demoted, instead of just removing them entirely from the group. In Signal's case, the same group chat attack in WhatsApp is also found in the app. It would appear as if the new member had the permission of the admin to join. This is claimed to indicate that your name has been mentioned four times in that specific WhatsApp group.

According to the researchers, the biggest weakness of the microblogging app is its extreme dependence towards servers that negates even the efforts that are made towards end-to-end encryption.

The idea behind encryption is to muddle your messages so only you and the recipient can read texts you send.

WhatsApp representatives told Wired there would be no fixes as a result of the research and that notifications of new chat additions are warning enough.

He says that users would be notified when a new person enters the group, which prevents "silent eavesdropping".

"While our investigation focuses on three major instant messaging applications, our methodology and the underlying model is of generic goal and can be applied to other secure group instant messaging protocols as well", researchers concluded in the paper.

Related:

  • Jerry Brown unveils $132 billion California budget for 2018-19

    Jerry Brown unveils $132 billion California budget for 2018-19

    Overall, his plan largely avoids new spending, instead putting $5 billion in surplus money into the state's rainy day fund. He's termed out after serving four terms, first in the 1970s and 1980s and again since 2011.
    Will Call Pakistan's Nuke Bluff If Tasked To Cross Border: Army Chief

    Will Call Pakistan's Nuke Bluff If Tasked To Cross Border: Army Chief

    However, Rawat admitted that the Chinese troop strength in Doklam had gone down recently. We also need to build capacity to move forces from western sector to northern sectors".
    Celebrity Big Brother's India Willoughby Stuns Housemates With Alien Abduction Claim

    Celebrity Big Brother's India Willoughby Stuns Housemates With Alien Abduction Claim

    "I know I probably share a degree of blame in that because I kept going on about gender because it was so important to me". Regretting some of her actions in the house, India confessed: "I'm not kidding myself, I got it wrong and I know that".
  • MLB Agent Fired After Being Accused Of Filming Clients In The Shower

    MLB Agent Fired After Being Accused Of Filming Clients In The Shower

    Apparently those standards include not secretly filming clients while they shower, because that's what Wood's been accused of. It remains unknown which players may have been involved, though Wood represented many first-round picks in recent years.
    Ties with India intact, says Israeli Ambassador

    Ties with India intact, says Israeli Ambassador

    Israel already is a major weapons supplier to India, selling it an average of $1 billion of military equipment each year. The visit begins in New Delhi where Mr Netanyahu will have dinner with PM Modi and meet Foreign Minister Sushma Swaraj.
    Pep Guardiola: 'Manchester City have to remain focused'

    Pep Guardiola: 'Manchester City have to remain focused'

    Marco Silva: "What I can say now is to come here, compete and do our best to take a good result when you start a game like this". Fernandinho insists every player will be ready for Manchester City's FA Cup clash with Burnley if Pep Guardiola needs them.
  • Chelsea Manning files to run for Senate seat

    Chelsea Manning files to run for Senate seat

    Manning pleaded guilty to some charges but was acquitted of the most serious charge brought against her: aiding the enemy. Manning filed her intent on January 11, according to a statement of candidacy filed with the Federal Election Commission.
    United States  freezes payment to UN agency for Palestinian refugees

    United States freezes payment to UN agency for Palestinian refugees

    UNRWA provides services to 5.3 million Palestinian refugees in the Palestinian territories, Jordan, Lebanon and Syria. Some Palestinian officials call Trump's threat blackmail.
    Swatting suspect makes first court appearance

    Swatting suspect makes first court appearance

    Tyler Barriss, 25, made his first appearance in Sedgwick County District Court following extradition from California. Barriss was allegedly targeting the home of a young woman he met online, authorities in Calgary said.
  • Fed extension gives Mass. CHIP funding through March

    Fed extension gives Mass. CHIP funding through March

    Steve Womack believes it's important to make sure CHIP is on "proper fiscal footing for an extended period of time". As it happens, that estimate only included seven years of funding, for reasons I couldn't quite figure out.
    Got batteries? Outage stalls giant tech show in Las Vegas

    Got batteries? Outage stalls giant tech show in Las Vegas

    Playing both sides, Panasonic also showed how it is bringing Google Assistant technology to cars as well. The Consumer Technology Association, which runs CES, tweeted that it was an "isolated power outage".
    EPS for Digital Realty Trust, Inc

    EPS for Digital Realty Trust, Inc

    It is positive, as 52 investors sold VNO shares while 118 reduced holdings. 26 funds opened positions while 66 raised stakes. The stock of British American Tobacco p.l.c. (NYSE:BTI) has "Overweight" rating given on Thursday, May 25 by Piper Jaffray.

Comments

Other news