A newly discovered security flaw in the Android version of WhatsApp allows another application to upload a user’s entire database of chats to a third-party server, without their consent.
The error stems from the Android operating system’s handling of external storage, as well as lax security standards in the WhatsApp application itself.
As detailed by Bas Bosschert, a dutch security consultant, the flaw allows any Android application with access to the device’s SD card to read and upload WhatsApp’s database.
“The WhatsApp database is saved on the SD card which can be read by any Android application if the user allows it to access the SD card,” Bosschert says. “And, as the majority of people allow everything on their Android device, this is not much of a problem.”
Android’s part in the weakness comes from the fact that the operating system only allows all-or-nothing access to the SD card. Any application which can read and write to the external storage can thus also read what other applications have stored there.
WhatsApp not only uses that external storage to hold its database, but on earlier versions of the app, does so without any encryption at all.
Bosschert adds that even later versions, which encrypt the database, do so using a key which can be easily extracted from the app using third-party tools like WhatsApp Xtract.
He concludes that “every application can read the WhatsApp database and it is also possible to read the chats from the encrypted databases.
“Facebook didn’t need to buy WhatsApp to read your chats.”
In order to avoid the risk of having their chats stolen, users should be wary of granting suspicious apps access to the SD card; a theoretical example given by Bosschert is a Flappy Bird clone app. If the application is from an untrusted publisher, they should exercise caution over granting the permissions it requests upon launch, especially if they include access to the SD card.
Opinion is split over whether WhatsApp or Android itself is more to blame for the flaw. Android’s policy of allowing total access to the SD card is at odds with Apple’s far more controlled security on iOS devices, where every app is “sandboxed” in a way that prevents others from accessing its data.
That Android openness allows developers to build programs which would be impossible on an iOS device, but also opens up the risk of errors such as that which has affected WhatsApp.
But this breach is the latest in a long string of security holes at WhatsApp. In October, a security researcher showed that it was possible to decrypt messages as they were sent using no more than data gained through eavesdropping on the WhatsApp connection.
And security researchers point out that one of the flaws which enabled this latest attack has been known about for more than a year; the WhatsApp Xtract tool, used to decrypted the database, was released in May 2012.
“Embedding cryptography into any product entails many subtleties, both at the granular level of code, and at the level of architecture,” explains Adrian Culley, Global Technical Consultant at Damballa. “In the fast moving world of mobile apps, advice is not always sought from skilled cryptographers at an early enough stage in development.”
WhatsApp, in an FAQ on its site, says that “WhatsApp communication between your phone and our server is encrypted.”
“Even though data sent through our app is encrypted,” it continues, “remember that if your phone or your friend’s phone is being used by someone else, it may be possible for them to read your WhatsApp messages. Please be aware of who has physical access to your phone.”
That warning was not enough for Germany’s privacy regulators who recommended in February that users switch to a more secure service.
Comments (…)
Sign in or create your Guardian account to join the discussion