0

I have been reading articles about exploits which allows someone to send an MP4, PDF or other file type through WhatsApp or other service, which self-executes to install malware without any user click or intervention.

I know some of these security holes were patched by WhatsApp recently but presumably other holes remain.

What steps can an average user to take to prevent this? For example, I can turn auto-download off.

Are there:

  • Any other phone or WhatsApp settings?
  • Scanning apps I can install which scan downloads for malware on Android?
  • Any other steps?
1

Your best option is simply to keep everything as up-to-date as possible.

Your example of choice is what is known as a 0-day exploit. Of course once the software provider learns about it and fixes it, it is no longer an zero-day, and the solution is simple: upgrade your software to the latest (protected) version. Before the software vendor learns about the exploit, it is quite possible that nothing can be done to stop yourself from being affected. Walking through your suggested steps:

  1. Auto Download: Turning off auto download won't help if a weakness allows an exploit to happen regardless of whether or not an attachment was downloaded
  2. WhatsApp settings: This in particular won't get you very far, and there usually aren't any options for things like, "Make me more secure". For instance browsers keep javascript sandboxed as much as possible to prevent malicious javascript from installing malware just from visiting the wrong site, but weaknesses in the sandbox (random example) can allow an attacker to do what they want anyway. In the event of such a weakness, a user who is using a vulnerable software version can't do anything to protect themselves, and by definition the software is unable to offer options to make itself safer.
  3. Malware scanners might help after-the-fact. It is very unlikely to detect a zero-day being exploited, but for the most part the exploit is used to install an actual payload. If the installed payload is something that the anti-virus recognizes, it may stop the exploit from becoming dangerous. However, if the exploit is used to install newer malware, or if it takes actions more directly (it starts spamming itself to your contacts list), then malware may be completely useless.

This is not to say that you can't do anything. In security, defense-in-depth is key. As a result doing things like installing malware scanners or disabling automatic downloads can help and may stop some actual exploits from happening. However, the particular example you picked out have often been the results of attackers exploiting zero-day vulnerabilities. When that happens, there is often nothing to be done except wait for a patch to come out from the provider and update quickly.

  • Thanks for the great explanation - very helpful. Any Android malware scanners you would recommend? I was reading that Android malware scanners get limited access to the OS and are not as useful as windows PC scanners though – Help Jan 23 at 5:55
-1

While auto download off is one of the best options, you may also want to disable the feature to install unknown apps.

  1. Disable the setting to install unknown apps from WhatsApp. Go to Settings > Biometrics and Security > Install Unknown Apps > WhatsApp. The setting should show you Not Allowed The other alternative is to Go to Settings > Apps > WhatsApp > Under the Advanced section, the setting for Install Unknown Apps should be Not Allowed

  2. Encrypt your SD Card. Encryption prevents the If you accidentally download a malicious file which tries to access the contents of the SD card con,

Besides the above, mobile AVs can help scan for malware. There are mobile AV's in Google Play Store for scanning,identifying and deleting malwares, for example, Kaspersky, AVG, Avast. However the free versions may not be as effective as the subscribed one's and may lack some features like scanning for ransomware.

You may want to read this article on how WhatsApp calling feature was exploited: https://www.maketecheasier.com/whatsapp-security-exploit-missed-call-hack/

Above all, our due diligence can save us from being hacked!

  • Encryption doesn't help against threats when the device is unlocked. – Joseph Sible-Reinstate Monica Jan 23 at 4:10
  • @joseph You are right. It's a general security tip that I gsve. Nothing wrong. – Icarus Jan 23 at 8:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.