A security bug has been discovered by Indian Security Researchers in the popular messaging app WhatsApp, wthat allows anyone to remotely crash WhatsApp just by sending a specially crafted message.
A “nice” vulnerability has been discovered in the widely popular messaging app WhatsApp that could be exploited by an attacker to remotely crash the app just by sending a specially crafted message. The two India based young independent Security researchers, Indrajeet Bhuyan and Saurav Kar, both 17-year old teenagers and have reproduced the exploitation of the flaw in the WhatsApp Message Handler. They also demonstrated the WhatsApp Message Handler vulnerability to The Hacker News.
TheHackersNews portal has also published a video PoC, In a demonstration video they showed that by sending a 2000 words (2kb in size) message in a special character set can crash the WhatsApp recipients’ app.
Proof-of-Concept (PoC) video for the attack:
As explained by the security researchers, the vulnerability in the WhatsApp is really worrying because in order to restore the app to normal condition, the affected user will have to delete his whole conversation and start a fresh chat session because opening the crafted message keeps on crashing WhatsApp unless the chat is deleted completely.
“What makes it more serious is that one needs to delete entire chat with the person they are chatting to in order to get back whatsapp work in normal,” Bhuyan told THN in an e-mail.
According to the researchers this serious flaw affects most of the Android versions currently available on the market including Jellybean, Kitkat, and all the below android versions. Similarly, Any member of your WhatsApp group could intentionally send a specially crafted message to exit people from the group and delete the group.
The vulnerability has not been tested on iOS yet, but it is sure that all versions of WhatsApp including 2.11.431 and 2.11.432 are affected with this vulnerability. The good news is that the attack does not work on Windows 8.1. These guys are really a wonder, what do you think?
WhatsApp which was recently bought by Facebook for $19 billion in February this year, has 600 Million users as of October 2014, and according to the researchers, an estimated number of users affected by the vulnerability could be 500 Million. WhatsApp was in news recently for making end-to-end encryption on all text messages as a default feature in an effort to boost the online privacy and security of its users around the world.