Just a GIF Image Could Have Hacked Your Android Phone Using WhatsApp

0

A picture is worth a thousand words, but a GIF is worth a thousand pictures.

Today, the short looping clips, GIFs are everywhere—on your social media, on your message boards, on your chats, helping users perfectly express their emotions, making people laugh, and reliving a highlight.

But what if an innocent-looking GIF greeting with Good morning, Happy Birthday, or Merry Christmas message hacks your smartphone?

Well, not a theoretical idea anymore.

WhatsApp has recently patched a critical security vulnerability in its app for Android, which remained unpatched for at least 3 months after being discovered, and if exploited, could have allowed remote hackers to compromise Android devices and potentially steal files and chat messages.

WhatsApp Remote Code Execution Vulnerability

The vulnerability, tracked as CVE-2019-11932, is a double-free memory corruption bug that doesn’t actually reside in the WhatsApp code itself, but in an open-source GIF image parsing library that WhatsApp uses.

Discovered by Vietnamese security researcher Pham Hong Nhat in May this year, the issue successfully leads to remote code execution attacks, enabling attackers to execute arbitrary code on targeted devices in the context of WhatsApp with the permissions the app has on the device.

“The payload is executed under WhatsApp context. Therefore it has the permission to read the SDCard and access the WhatsApp message database,” the researcher told The Hacker News in an email interview.

“Malicious code will have all the permissions that WhatsApp has, including recording audio, accessing the camera, accessing the file system, as well as WhatsApp’s sandbox storage that includes protected chat database and so on…”

How Does WhatsApp RCE Vulnerability Work?

WhatsApp uses the parsing library in question to generate a preview for GIF files when users open their device gallery before sending any media file to their friends or family.

Thus, to be noted, the vulnerability does not get triggered by sending a malicious GIF file to a victim; instead it gets executed when the victim itself simply opens the WhatsApp Gallery Picker while trying to send any media file to someone.

LEAVE A REPLY

Please enter your comment!
Please enter your name here