WhatsApp security vulnerability could have exploited two billions users
A security vulnerability in popular messaging app WhatsApp's image filter function discovered by Check Point Research could have exploited more than two billion users worldwide if left unpatched.
It is estimated more than 55 billion messages are being sent daily over WhatsApp, with 4.5 billion photos and one billion videos shared per day.
Check Point Research recommends for WhatsApp users to always keep their apps and operating systems updated.
Image Filter Function
According toe CPR, the vulnerability was rooted in WhatsApp's image filter function. Image filtering is a process through which pixels of the original image are modified to achieve some visual effects, such as blur or sharpen.
During their research study, CPR learned that switching between various filters on crafted GIF files indeed caused WhatsApp to crash. CPR identified one of the crashes as a memory corruption.
CPR promptly reported the problem to WhatsApp, who named for the vulnerability CVE-2020-1910, detailing it as an out-of-bounds read and write issue. Successful exploitation of the vulnerability would have required an attacker to apply specific image filters to a specially crafted image and send the resulting image.
Coordinated Disclosure
CPR disclosed its findings to WhatsApp on November 10, 2020. WhatsApp verified and acknowledged the security issue. WhatsApp deployed a fix in version 2.21.2.13, outlining CVE-2020-1910 in its February Security Advisory update.
"With over two billion active users, WhatsApp can be an attractive target for attackers," says Oded Vanunu, head of products vulnerabilities research at Check Point.
"Once we discovered the security vulnerability, we quickly reported our findings to WhatsApp, who was cooperative and collaborative in issuing a fix," he says.
"The result of our collective efforts is a safer WhatsApp for users worldwide.
WhatsApp says, "We regularly work with security researchers to improve the numerous ways WhatsApp protects people's messages, and we appreciate the work that Check Point does to investigate every corner of our app.
"People should have no doubt that end-to-end encryption continues to work as intended and people's messages remain safe and secure. This report involves multiple steps a user would have needed to take and we have no reason to believe users would have been impacted by this bug.
"That said, even the most complex scenarios researchers identify can help increase security for users. As with any tech product, we recommend that users keep their apps and operating systems up to date, to download updates whenever they're available, to report suspicious messages, and to reach out to us if they experience issues using WhatsApp.
