On July 15, cybersecurity firm Symantec revealed that attackers can manipulate users’ WhatsApp and Telegram media files on Android because of a ‘Media File Jacking’ flaw in the apps. It affects WhatsApp for Android by default, and Telegram for Android if certain features are enabled. “It stems from the lapse in time between when media files received through the apps are written to the disk, and when they are loaded in the apps’ chat user interface (UI) for users to consume,” Symantec said.
How does this flaw work?
WhatsApp, by default, saves received media files in external storage. On Android devices, files saved to external storage are “world-readable/writeable, so they can be modified by other apps or users beyond the app’s control”, while files saved to internal storage can be accessed only by the app itself. Similarly, in Telegram, if a user enables ‘Save to Gallery’ feature, files will be saved in external storage.
Consequently, when these files are saved to external storage, other apps with write-to-external storage permission can potentially manipulate these media files. Symantec found that nearly 50% of a given device’s apps have this permission.
Here’s what WhatsApp told MediaNama:
“WhatsApp has looked closely at this issue and it’s similar to previous questions about mobile device storage impacting the app ecosystem. WhatsApp follows current best practices provided by operating systems for media storage and looks forward to providing updates in line with Android’s ongoing development. The suggested changes here could both create privacy complications for our users and limit how photos and files could be shared.”
But what about end-to-end encryption?
This vulnerability affects media files. Thus, while your text messages sent on WhatsApp’s end-to-end encryption channels are secure (because they are encrypted), your media files, by virtue of being saved in an unsecure manner, expose the entire ecosystem to manipulation.
How can media files be manipulated?
There are 2 steps to handling media files: downloading them to external storage, and retrieving them from there for users to consume via the apps. The time between these two steps is when malware can instantaneously analyse and manipulate the files (or just replace them with the attacker’s chosen files) for malicious gain.
Symantec pointed out that the the Media File Jacking vulnerability points to a bigger issue of app developers’ non-secure use of storage resources.
Here are potential scenarios where this vulnerability can be abused:
- Image manipulation: Through this, a user may unintentionally land up sending a manipulated image.
- Payment manipulation: Just as images are manipulated, invoices can also be manipulated to trick customers into making payments to illegitimate accounts. Since WhatsApp is also used to conduct business, this could affect multiple victims at once.
- Audio message spoofing: An attacker, using voice reconstruction via deep learning technology, can alter audio messages from trusted sources, and use them to scam people.
- Fake news on Telegram: Admins on Telegram use the concept of ‘channels’ to broadcast messages to an unlimited number of subscribers. An attacker can change the media files that appear in the channel feed in real time, and propagate fake news.
How can Android users protect themselves?
The main aim is to disable the feature that saves media files to external storage:
- For WhatsApp: Settings > Chats > Media Visibility (turn it off)
- For Telegram: Settings > Chat Settings > Save to Gallery (turn it off)
WhatsApp and Telegram just don’t learn
- On July 15, Symantec also reported that a malicious app named MobonoGram 2019 was advertising itself as an unofficial version of the Telegram app, and claimed to provide more features than both the official app, and other unofficial versions in the market. Symantec found that the app ran a few services on the device sans user consent, and loaded and browsed malicious websites in the background. It was available in Iran and Russia, regions that have banned Telegram. It had been downloaded more than 100,000 times from the Google Play Store before it was removed.
- In May 2019, it was discovered that a vulnerability in WhatsApp allowed attackers to inject Israeli spyware into Android and iOS devices simply by calling the devices.
- In October 2018, a security researcher found that Telegram’s desktop app was leaking public and private IP addresses during voice calls
*** Update (2:04 pm): This article was updated with WhatsApp’s response.
