4

My work requires (and depends on) Whatsapp for daily sharing of files with many people (PDF, PowerPoint, Word, Images, Web links...), and I was wondering if it is possible that someone can hack our phones by sending us malware via Whatsapp.

For example, let's say they send me a virus that pretends to be a legitimate PDF. Is it okay to "just install it" on Whatsapp? What happens if I installed it but never opened it? Can that affect my phone or I have to open/view it?

This is extremely important to me and my team, and I will share your answers with them because we seriously need more awareness on this. Thanks!

  • Side note: Maybe its not good to use WhatsApp (which is designed for chatting) for file-sharing. And think about security (what make facebook with your files? What make facebook with the metadata? Why is each few months a new zero-day discovered?) There is a lot of software out there for file-sharing - also free or cheap. I recommend nextcloud. – akop Dec 15 '19 at 17:35
3

I recently read Hackers can use a WhatsApp flaw in the way it handles video to take control of your phone, so theoretically it is possible via PDF as well, depending on your OS and possible flaws in WhatsApp and your phone’s OS.

| improve this answer | |
  • 4
    Or in other words: there is currently no publicly known exploit for this which does not mean that there is no such exploit at all or that some future changes made to WhatsApp or the underlying OS might lead to such an exploit. There is no 100% security. – Steffen Ullrich Dec 14 '19 at 13:55
2

Yes, it is entirely possible, and several file types did compromise the app as did other methods. Examples:

  • CVE-2019-11931 — made it possible for attackers to send a specially crafted MP4 file to remotely execute malicious code on the victim’s device without any intervention (A stack-based buffer overflow could be triggered. The issue was present in parsing the elementary stream metadata of an MP4 file and could result in a DoS [denial of service] or RCE [remote code execution] ).

  • CVE-2019-11932 - Whatsapp GIF RCE exploit - Remote Code Execution via .gif file (double-free memory vulnerability in a WhatsApp image preview library called libpl_droidsonroids_gif.so).

  • CVE-2019-3568 - A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of RTCP packets sent to a target

In the case of .PDFs, there is always the possibility that specially crafted files may do something, even in simple scenarios like previewing them. More than that, if an app that appears to be legitimate but is in fact malicious, watches for PDF invoice files received via WhatsApp, then can swap the displayed bank account information in the invoice with that of a bad actor. The customer receives the invoice, which they were expecting to begin with, but has no knowledge that it’s been altered. By the time the trick is exposed, the money may be long gone. To make matters worse, the invoice hack could be broadly distributed in a non-targeted way, looking for any invoices to manipulate, affecting multiple victims the app.

As someone said in the comments, WhatsApp is not a file sharing app and such usage should be avoided if possible.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.