wordpress blog stats
Connect with us

Hi, what are you looking for?

Vulnerability in WhatsApp and Telegram for Android exposes users’ media files

Logos of WhatsApp and Telegram

On July 15, cybersecurity firm Symantec revealed that attackers can manipulate users’ WhatsApp and Telegram media files on Android because of a ‘Media File Jacking’ flaw in the apps. It affects WhatsApp for Android by default, and Telegram for Android if certain features are enabled. “It stems from the lapse in time between when media files received through the apps are written to the disk, and when they are loaded in the apps’ chat user interface (UI) for users to consume,” Symantec said.

How does this flaw work?

WhatsApp, by default, saves received media files in external storage. On Android devices, files saved to external storage are “world-readable/writeable, so they can be modified by other apps or users beyond the app’s control”, while files saved to internal storage can be accessed only by the app itself. Similarly, in Telegram, if a user enables ‘Save to Gallery’ feature, files will be saved in external storage.

Consequently, when these files are saved to external storage, other apps with write-to-external storage permission can potentially manipulate these media files. Symantec found that nearly 50% of a given device’s apps have this permission.

Here’s what WhatsApp told MediaNama:

“WhatsApp has looked closely at this issue and it’s similar to previous questions about mobile device storage impacting the app ecosystem. WhatsApp follows current best practices provided by operating systems for media storage and looks forward to providing updates in line with Android’s ongoing development. The suggested changes here could both create privacy complications for our users and limit how photos and files could be shared.”

But what about end-to-end encryption?

This vulnerability affects media files. Thus, while your text messages sent on WhatsApp’s end-to-end encryption channels are secure (because they are encrypted), your media files, by virtue of being saved in an unsecure manner, expose the entire ecosystem to manipulation.

Advertisement. Scroll to continue reading.

How can media files be manipulated?

There are 2 steps to handling media files: downloading them to external storage, and retrieving them from there for users to consume via the apps. The time between these two steps is when malware can instantaneously analyse and manipulate the files (or just replace them with the attacker’s chosen files) for malicious gain.

Symantec pointed out that the the Media File Jacking vulnerability points to a bigger issue of app developers’ non-secure use of storage resources.

Here are potential scenarios where this vulnerability can be abused:

  1. Image manipulation: Through this, a user may unintentionally land up sending a manipulated image.
  2. Payment manipulation: Just as images are manipulated, invoices can also be manipulated to trick customers into making payments to illegitimate accounts. Since WhatsApp is also used to conduct business, this could affect multiple victims at once.
  3. Audio message spoofing: An attacker, using voice reconstruction via deep learning technology, can alter audio messages from trusted sources, and use them to scam people.
  4. Fake news on Telegram: Admins on Telegram use the concept of ‘channels’ to broadcast messages to an unlimited number of subscribers. An attacker can change the media files that appear in the channel feed in real time, and propagate fake news.

How can Android users protect themselves?

The main aim is to disable the feature that saves media files to external storage:

  • For WhatsApp: Settings > Chats > Media Visibility (turn it off)
  • For Telegram: Settings > Chat Settings > Save to Gallery (turn it off)

WhatsApp and Telegram just don’t learn

  • On July 15, Symantec also reported that a malicious app named MobonoGram 2019 was advertising itself as an unofficial version of the Telegram app, and claimed to provide more features than both the official app, and other unofficial versions in the market. Symantec found that the app ran a few services on the device sans user consent, and loaded and browsed malicious websites in the background. It was available in Iran and Russia, regions that have banned Telegram. It had been downloaded more than 100,000 times from the Google Play Store before it was removed.
  • In May 2019, it was discovered that a vulnerability in WhatsApp allowed attackers to inject Israeli spyware into Android and iOS devices simply by calling the devices.
  • In October 2018, a security researcher found that Telegram’s desktop app was leaking public and private IP addresses during voice calls

*** Update (2:04 pm): This article was updated with WhatsApp’s response.

Written By

Send me tips at aditi@medianama.com. Email for Signal/WhatsApp.

MediaNama’s mission is to help build a digital ecosystem which is open, fair, global and competitive.



Looking at the definition of health data, it is difficult to verify whether health IDs are covered by the Bill.


The accession to the Convention brings many advantages, but it could complicate the Brazilian stance at the BRICS and UN levels.


In light of the state's emerging digital healthcare apparatus, how does Clause 12 alter the consent and purpose limitation model?


The collective implication of leaving out ‘proportionality’ from Clause 12 is to provide very wide discretionary powers to the state.


The latest draft is also problematic for companies or service providers that have nothing to with children's data.

You May Also Like


Google has released a Google Travel Trends Report which states that branded budget hotel search queries grew 179% year over year (YOY) in India, in...


135 job openings in over 60 companies are listed at our free Digital and Mobile Job Board: If you’re looking for a job, or...


Rajesh Kumar* doesn’t have many enemies in life. But, Uber, for which he drives a cab everyday, is starting to look like one, he...


By Aroon Deep and Aditya Chunduru You’re reading it here first: Twitter has complied with government requests to censor 52 tweets that mostly criticised...

MediaNama is the premier source of information and analysis on Technology Policy in India. More about MediaNama, and contact information, here.

© 2008-2021 Mixed Bag Media Pvt. Ltd. Developed By PixelVJ

Subscribe to our daily newsletter
Your email address:*
Please enter all required fields Click to hide
Correct invalid entries Click to hide

© 2008-2021 Mixed Bag Media Pvt. Ltd. Developed By PixelVJ