With over 500 million daily active users, WhatsApp is one of the world’s most popular messaging platforms. In an effort to provide even more ways to connect beyond iOS and Android, WhatsApp introduced a desktop version of the app in 2016, which allowed users to stay in touch from their home or work computer. However, a researcher from The Hacker News recently disclosed multiple vulnerabilities in WhatsApp which, if exploited, could allow remote attackers to compromise the security of billions of users.
How safe is WhatsApp?
According to researcher Gal Weizman, the flaws were found in WhatsApp Web, the browser version of the messaging platform. Weizman revealed that WhatsApp Web was vulnerable to an open-redirect flaw, which allows remote hackers to redirect victims to suspicious, arbitrary websites. If a hacker sent an unsuspecting victim a message containing one of these arbitrary links, they could then trigger cross-site scripting attacks. These attacks are often found in web applications and can be used by hackers to bypass access controls by injecting malicious code into trusted websites.
WhatsApp Web hack
If the victim clicks on the link in the message, the hacker could remotely gain access to all the files from their Windows or Mac computer, which increases the risk for identity theft. What’s more, the open-redirect flaw could have also been used to manipulate previews of the domain WhatsApp displays when links are sent through their platform. This provides hackers with another avenue to trick users into falling for phishing attacks
How to stay safe
How can users continue to use messaging platforms like WhatsApp without putting themselves at risk of an attack? Follow these security tips for greater peace of mind:
- Update, update, update. If you’re a WhatsApp Web user, be sure to update to the latest version to install the security patch for this flaw.
- Think before you click. Be skeptical of ads shared on social media sites and messages sent to you through platforms like Facebook, Twitter, and WhatsApp. If you receive a suspicious message from an unknown sender, it’s best to avoid interacting with the message.
- Hover over links to see and verify the URL. If someone you don’t know sends you a link, hover over the link without actually clicking on it. This will allow you to see a link preview. If the URL looks suspicious, don’t interact with it and delete the message altogether.
To stay updated on all things McAfee and on top of the latest consumer and mobile security threats, follow @McAfee_Home on Twitter, listen to our podcast Hackable?, and ‘Like’ us on Facebook.
Stay Updated
Follow us to stay updated on all things McAfee and on top of the latest consumer and mobile security threats.
