WhatsApp und Telegram waren von Sicherheitslücke betroffen

The exploitation of this vulnerability starts with the attacker sending an innocent looking file to the victim, which contains malicious code. The file can be modified to contain attractive content to raise the chances a user will open it. Once the user clicks to open it, the malicious file allows the attacker to access WhatsApp’s and Telegram’s local storage, where user data is stored. From that point, the attacker can gain full access to the user’s account and account data. The attacker can then send the malicious file to the all victim’s contacts, opening a dangerous door to a potentially widespread attack over the WhatsApp and Telegram networks.

A company called Check Point has discovered a way of taking over a WhatsApp account provided that your target simply opened a photo you sent them. No additional actions from the target were required. Some media irresponsibly reported that „the same“ vulnerability was discovered in Telegram.

This is not true, Telegram never had this issue.

What did you have?

Last week, Check Point pointed out a different issue in Telegram Web that was based on the same idea, but had very different implications for the end user. For this version to work, you had to convince your target to do exactly the following:

1. Hit ‚Play‘ to start watching a malicious video via Telegram Web in Chrome. (At this point a WhatsApp account is already compromised, but nothing happens in Telegram.)

2. Then, as the video is already playing, right-click on the running video and select „open in a new tab“ from the menu.

Your target had to do exactly that, in this exact order. The scenario would NOT work:

• If you simply opened the video to play it in a new tab. No effect whatsoever.
• If you opened the video in full-screen mode. No effect either.

As you can see, the attack against Telegram required very unusual user interaction to succeed.