Facebook, the owner of the WhatsApp messaging application, has announced that it has discovered a potentially dangerous security problem related to WhatsApp. The vulnerability has to do with video playback within this software, and specifically with a buffer overflow issue related to MP4 videos. The critical vulnerability, which affects both iOS and Android devices, allows intruders to steal users’ personal information stored in the application by sending a malicious video in MP4 format. This video is specially designed to hijack the recipient’s phone, without the user knowing.
There is not much additional information on this, but the caveat is dire: compromised systems are at risk of denial of service attacks or even remote code execution on the infected device. This could pose the threat of malware being installed on an infected device, either to spy on the owner or to remotely take over the device.
Facebook says the “potential problem” was discovered internally, but in these days of growing attacks on messaging platforms, such vulnerabilities must be taken seriously and corrective actions must be swift and thorough.
The affected versions
According to the company that owns WhatsApp, Facebook, the potential problem affects the following versions of WhatsApp: Android versions prior to 2.19.274, iOS versions prior to 2.19.100, Enterprise Client versions prior to 2.25.3, Windows Phone older and including 2.18.368, Business for Android prior to 2.19.104, and Business for iOS prior to 2.19.100.
Needless to say, the presence of vulnerability alone does not mean that it can be used for nefarious purposes. As is often the case, it can be an entry point for a chain of exploits that ties together a group of security vulnerabilities, allowing a hacker to penetrate digital protections.
While there is no indication that the problem has been exploited, the bug’s disclosure comes weeks after WhatsApp revealed that at least two dozen Dalit academics, lawyers, activists and journalists in India were under surveillance by operators. of threats using Pegasus spyware from security firm NSO Group.
Update!
According to the statement issued by Facebook, this vulnerability has affected both iOS and Android devices in old versions of WhatsApp and although the error was patched with the update uploaded on October 3, it continues to affect devices with outdated software. So it is crucial that you update WhatsApp to the latest version to mitigate the risk.
All WhatsApp users should check which version is on their device to make sure they are running the latest version of the app on all their platforms, and if not, they should be updated as soon as possible. Recall that using WhatsApp as the delivery channel for an infection creates a remarkably easy attack vector – you only need one phone number, after all.
