Any WhatsApp user can have their account taken away. You don't need to be a hacker to do this

software Soft Safety User Internet Internet software Technology

13 April 2021 11:25 13 Apr 2021 11:25 |

Share

There is a flaw in WhatsApp that allows attackers with zero hacking and programming skills to permanently block any user's account. They only need to know their phone number and nothing else, and there is no way to protect themselves from potential blocking. WhatsApp developers are in no hurry to fix the problem.

New bug in WhatsApp

Each WhatsApp user can lose their profile at any second with a minimal chance of recovery. According to Forbes, it is simply impossible to protect against this, and the attacker will not even need to hack the gadget - he just needs to know the user's phone number, after which he can initiate the procedure for blocking him without the possibility of re-authorization in the system.

The ability to deprive anyone of using WhatsApp is a consequence of a giant vulnerability discovered in the messenger by information security specialists Luis Carpintero and Ernesto Pereña (Ernesto Canales Pereña). They notified the developers of WhatsApp about their discovery, but they have not yet released a patch that fixes the breach, thereby leaving 2 billion users at risk of losing their account.

WhatsApp does nothing to protect users from blocking their profile

WhatsApp is the most popular instant messenger in the world. According to Statista.com, in terms of the number of monthly active users as of January 2021, with its more than 2 billion, it was ahead of Facebook Messenger (1.3 billion) and Chinese WeChat (1.21 billion), along with QQ (617 million). WhatsApp has been owned by Facebook since February 2014.

How vulnerability works

Vulnerability in WhatsApp makes it possible to completely block the victim's account and is carried out in two very simple steps, in each of which the perpetrator does not even need hacking or social engineering skills - he will not contact the profile owner at all.

WhatsApp standard authorization window

At the first stage, an attacker simply needs to install WhatsApp on a smartphone and try to log in using the desired phone number. The messenger will send him an SMS with a confirmation code, and here there is a calculation that the owner of the number will ignore them. After several such attempts, the application on the attacker's device will report too frequent authorization attempts and allow the next one only after 12 hours. At the same time, WhatsApp on the victim’s device will continue to work as before.

Notification that authorization was not possible due to an excessive number of attempts

In the second step, the attacker registers a new email address and writes a letter to WhatsApp technical support saying that his account was lost or stolen. He asks to turn it off and indicates the number of the victim. WhatsApp can send an automatic email asking you to write the number again, and the attacker will do it.

Letter to WhatsApp technical support requesting blocking

Next, WhatsApp, without making sure that the real owner of the account wrote to technical support, initiates the blocking procedure. After about an hour, the messenger will suddenly stop working on the victim's device - she will see a message that her number is no longer registered in the system. “It could be because you registered it on another phone. If you haven't done so, verify your phone number to log into your account again," the notification will say.

WhatsApp response with confirmation of the request

All of this will work even if the user has enabled two-factor authentication. An attempt to request a new code will fail - WhatsApp will allow you to do this only after 12 hours.

Bonus stage and full blocking

If the attacker decides to stop at the second stage, then everything will end up with just the inability of the user to connect to WhatsApp with his number for several hours. After a maximum of 12 hours, the user will be able to regain control over his account and continue working in the messenger exactly until someone wants to repeat the "trick" with the blocking.

But in fact there is an additional, third stage, leading to a complete blocking of the account.

This stage can actually become the second - the attacker does not have to send a letter to WhatsApp support, he can just wait 12 hours, and then again make several attempts to register someone else's number on his phone. After the third 12-hour blocking, WhatsApp will break, and instead of a timer counting down the time until the next authorization attempt, it will show “-1 second”, moreover, constantly. This is a malfunction in the messenger, which cannot be bypassed.

A stuck timer on the phones of the victim (left) and the attacker

This picture will be observed both on the hacker's device and on the victim's smartphone, and as a result, no one else will be able to log in to the messenger using this phone number. The only thing left is to try to contact WhatsApp technical support and look for ways to solve the problem.

WhatsApp does not solve the problem

A Forbes article shedding light on a new WhatsApp issue was published on April 10, 2021. By April 13, 2021, the developers have not released an update to fix it and have not set a release date for it.

Cheap loans and new factories: how to develop Russian electronics?

Import substitution

Instead, they are preparing to implement a new privacy policy, according to which the messenger will automatically transfer huge amounts of personal data of users to Facebook for better ad targeting.

This policy was intended to be implemented by WhatsApp on February 8, 2021, but was forced to temporarily abandon this idea due to a flurry of criticism. The new date for its entry into force is May 15, 2021, and all those who are not going to agree with it are in for a very serious punishment.

In February 2021, CNews wrote that those who disagree with the new WhatsApp privacy policy will no longer be able to send and receive text messages. Developers will leave them only voice calls. Moreover, the profiles of those users who stop using WhatsApp and switch to other messengers are guaranteed to be completely deleted.

WhatsApp other issues

WhatsApp is known not only for the fact that it is used by billions of people, but also for the fact that if it appreciates its users, it is far from always. So, for example, in June 2020, it became known that some phone numbers linked to user profiles in WhatsApp had been in the public domain for a long time and even got into Google search results. In total, with the help of Google, it was possible to find up to the number of about 300 thousand users of the messenger, and this problem was of a global nature.

WhatsApp is still in first place in terms of the number of users

In November 2019, CNews reported that WhatsApp users were automatically permanently banned for participating in harmless group chats. It turned out to be possible to fall under sanctions for changing the name of the chat to something that would seem to the moderators of the service as something sinister, illegal or malicious.

Sergey Belostotsky, PIX BI product owner: BI systems are not a luxury, but the norm for both large businesses and SMBs

Market

At the same time, WhatsApp was in no hurry to fix this failure. The employees of the messenger responded to all requests from the victims about the reasons for blocking that the users themselves violated the rules of the service, and the fault in blocking lies solely with them. As a result, people had to either change their phone number to register a new profile, or go to other services - Telegram, Viber, Signal and others.

• How to comply with Presidential Decree No. 250 "On Additional Information Security Measures"

Elyas Kasmi




Attackers can remotely block a WhatsApp account

A hacker can remotely initiate the process of deleting a WhatsApp account, security experts say, without even two-factor authentication built into the application protecting users. Account deactivation is possible due to two imperfections of the messenger. More details about the scheme - in the material "Gazety.Ru".

A new vulnerability has been discovered in WhatsApp, reports The Forbes portal.

Cybersecurity researchers have learned that an attacker, knowing the phone number of the alleged victim, can remotely deactivate an account on a user's device. At the same time, it will no longer be possible to return access to the account, and even two-factor authentication will not stop the hacker.

“This is another opportunity for hackers that could affect millions of users who could become potential victims. A lot of people rely on WhatsApp as their main mode of communication and the fact that it is so easy to hack the messenger is alarming, ”says ESET specialist Jake Moore.

The scheme works as follows - when a user first installs the application on their phone, the platform sends an SMS code to verify the account. The attacker enters the victim's phone number to enter, she receives an SMS code for verification, which cannot be shared with anyone. The user, as a rule, ignores this message, and the hacker enters the code at random. The action is repeated and continues until WhatsApp stops sending secret combinations for 12 hours.

After that, the attacker registers a new email address, for example, in Gmail, and sends an email to the WhatsApp technical support address with a request to deactivate the account and indicate the victim number there. The fact is that letters are processed automatically and no verification of the identification of the account holder is performed.

“Your number is no longer registered with WhatsApp on this phone because it was registered on another phone. If you haven't done so, verify your phone number to log into your account," the messenger notifies the user.

The user enters a phone number to recover their account, but it won't work because WhatsApp blocked sending six-digit codes for 12 hours.

If the attacker after 12 hours continues to request and enter the wrong code, then on the third round, WhatsApp will inform that the next entry is possible only after -1 second, and there will be no more opportunity to enter the code to enter WhatsApp - at this stage, the messenger simply “breaks ".

If an attacker sends a letter in support about blocking the account after that, then the user will no longer be able to log into his account, Dmitry Bondar, director of the Solar inRights Access Control Competence Center of Rostelecom-Solar, explained to Gazeta. Ru.

“It appears that this WhatsApp login vulnerability allows anyone to block any WhatsApp account quite easily. However, it is not yet clear how attackers can monetize this attack, and, most likely, WhatsApp will close this vulnerability fairly quickly,” the expert noted.

According to Viktor Chebyshev, a mobile threat researcher at Kaspersky Lab, the phone number is the most vulnerable point in the WhatsApp ecosystem.

“If it ends up in the hands of an ill-wisher, he can really try to disable the messenger on the user's smartphone. However, you should not expect a large wave of attacks of this kind, so this is not a reason to stop using the popular service. For most scammers, the discovered vulnerability will not allow them to receive any benefit, ”the expert believes.

For attackers who are interested in attacking specific people, the benefit of disabling the messenger for some time is also doubtful: if the user notices that the messenger on his phone is not working, he will be able to establish contact with people in another way: call, send SMS , write in another messenger, meet in person, Chebyshev notes.

"If WhatsApp suddenly shows a window with the text 'Your phone number is no longer registered with WhatsApp on this phone', you should immediately contact WhatsApp support and provide evidence that you are you. Unfortunately, any application may contain certain errors. Most likely, WhatsApp will soon fix the procedure for deregistering a phone number by adding the possibility of two-factor authorization, so attackers will not be able to disable the messenger on the device with one message, ”the expert shared.

Gleb Karmanov, consultant of the Center for Information Security of the Jet Infosystems company, noted that the messenger does not currently have verification by e-mail address.

According to the expert, the purpose of this scheme is to start the process of deleting the WhatsApp account. It became possible to technically implement this scheme due to two imperfections in the processes of the messenger.

First, knowing the phone number, you can already try to enter the account associated with this number.

---

Learn more

• 
  How to create ecommerce page on facebook
• 
  How to hack other peoples instagram
• 
  How to retrieve deleted instagram photos
• 
  How to make instagram flyers
• 
  How to download viber on samsung
• 
  How to get rid of old accounts on instagram
• 
  How do i get my whatsapp chat history back on iphone
• 
  How to view private instagram profiles tiktok
• 
  How can i see who viewed my post on instagram
• 
  How to check if someone is following you instagram
• 
  How to monitor instagram activity