Protective steps to prevent files sent through WhatsApp from installing malware

Question

I have been reading articles about exploits which allows someone to send an MP4, PDF or other file type through WhatsApp or other service, which self-executes to install malware without any user click or intervention.

I know some of these security holes were patched by WhatsApp recently but presumably other holes remain.

What steps can an average user to take to prevent this? For example, I can turn auto-download off.

Are there:

• Any other phone or WhatsApp settings?
• Scanning apps I can install which scan downloads for malware on Android?
• Any other steps?

Answer 1

Your best option is simply to keep everything as up-to-date as possible.

Your example of choice is what is known as a 0-day exploit. Of course once the software provider learns about it and fixes it, it is no longer an zero-day, and the solution is simple: upgrade your software to the latest (protected) version. Before the software vendor learns about the exploit, it is quite possible that nothing can be done to stop yourself from being affected. Walking through your suggested steps:

1. Auto Download: Turning off auto download won't help if a weakness allows an exploit to happen regardless of whether or not an attachment was downloaded
2. WhatsApp settings: This in particular won't get you very far, and there usually aren't any options for things like, "Make me more secure". For instance browsers keep javascript sandboxed as much as possible to prevent malicious javascript from installing malware just from visiting the wrong site, but weaknesses in the sandbox (random example) can allow an attacker to do what they want anyway. In the event of such a weakness, a user who is using a vulnerable software version can't do anything to protect themselves, and by definition the software is unable to offer options to make itself safer.
3. Malware scanners might help after-the-fact. It is very unlikely to detect a zero-day being exploited, but for the most part the exploit is used to install an actual payload. If the installed payload is something that the anti-virus recognizes, it may stop the exploit from becoming dangerous. However, if the exploit is used to install newer malware, or if it takes actions more directly (it starts spamming itself to your contacts list), then malware may be completely useless.

This is not to say that you can't do anything. In security, defense-in-depth is key. As a result doing things like installing malware scanners or disabling automatic downloads can help and may stop some actual exploits from happening. However, the particular example you picked out have often been the results of attackers exploiting zero-day vulnerabilities. When that happens, there is often nothing to be done except wait for a patch to come out from the provider and update quickly.

Answer 2

While auto download off is one of the best options, you may also want to disable the feature to install unknown apps.

1. Disable the setting to install unknown apps from WhatsApp. Go to Settings > Biometrics and Security > Install Unknown Apps > WhatsApp. The setting should show you Not Allowed The other alternative is to Go to Settings > Apps > WhatsApp > Under the Advanced section, the setting for Install Unknown Apps should be Not Allowed

2. Encrypt your SD Card. Encryption prevents the If you accidentally download a malicious file which tries to access the contents of the SD card con,

Besides the above, mobile AVs can help scan for malware. There are mobile AV's in Google Play Store for scanning,identifying and deleting malwares, for example, Kaspersky, AVG, Avast. However the free versions may not be as effective as the subscribed one's and may lack some features like scanning for ransomware.

You may want to read this article on how WhatsApp calling feature was exploited: https://www.maketecheasier.com/whatsapp-security-exploit-missed-call-hack/

Above all, our due diligence can save us from being hacked!