Privacy News Attackers Use Voicemail Hack to Steal WhatsApp Accounts

[upnorth]

Content source

https://nakedsecurity.sophos.com/2018/10/08/attackers-use-voicemail-hack-to-steal-whatsapp-accounts/

Another online account hijacking attack has emerged, this time targeting WhatsApp. The Israeli agency responsible for cybersecurity has warned its citizens about the attack, which can often be conducted without any knowledge or interaction on their part. All the attacker needs is the victim’s phone number.

First documented by security researchers last year, the security flaw has now hit the mainstream. Last week, ZDNet reported that the Israeli National Cybersecurity Authority issued an alert warning that WhatsApp users could lose control of their accounts. The hack capitalises on users’ tendency not to change default access credentials on cellphone voicemail numbers. The attacker makes a request to register the victim’s telephone number to the WhatsApp application on their own phone. By default, WhatsApp sends a six-digit verification code in an SMS text message to the victim’s phone number, to verify that the person making the request owns it. Ideally, the victim would see the message, alerting them that something was up. The attacker avoids that by launching the attack at a time when the victim would not answer their phone, such as in the middle of the night, or while they are on a flight. Many users may even have their phones set to ‘do not disturb’ during this time. The attacker doesn’t have access to the victim’s phone, and so cannot see the code to enter it. WhatsApp then offers to call the victim’s number with an automated phone message reading out the code. Because the victim is not accepting calls, the automated message is left as a voicemail. The attacker then exploits a security flaw on many carrier networks, which provide generic telephone numbers that users can call to access voicemail. The only credential required to hear the voicemail is a four-digit PIN, and many carriers set this by default to something simple like 0000 or 1234. These default passwords are easily discovered online. When the attacker uses the default PIN to access the victim’s voicemail, they can hear the code and then enter it into their own device, completing the transfer of the victim’s phone number to their own WhatsApp account.

To seal the deal, the attacker can then enable two-step verification, which is an optional feature that WhatsApp has been offering since 2017. This requires the user to set a custom PIN, which they must then re-enter if they wish to reverify their phone number. Turning on this feature prevents the victim from regaining control over their own phone number.

 

[vtqhtr413]

I'm not a WhatsApp user but I wonder what the attacker would gain or is it more of a prank?

 

[Eddie Morra]

I'm not a WhatsApp user but I wonder what the attacker would gain or is it more of a prank?

The attacker would basically gain access to your WhatsApp account if the attack is carried out successfully. They'd have the same access you would have on your own account.

Why am I not surprised though? Google and Facebook are nothing but trouble these days.

 

[upnorth]

 

[ChemicalB]

Not sure I've understood the mechanism, but maybe it is time to move to Telegram then..

 

[upnorth]

Not sure I've understood the mechanism, but maybe it is time to move to Telegram then..

If you check in the end of the ZDnet link article, you will find a bit deeper explanation from the security researcher Martin Vigo.

 

[Weebarra]

I'm going to smash up every device i own and delete every account i have ever had as every day, someone somewhere is hacked and i am vulnerable. :emoji_fearful:

I don't use whatsapp anyway

 

[Eddie Morra]

I don't use whatsapp anyway

It's owned by Facebook. That's enough to make me run away and many others too.

It isn't even a paranoia thing. I just don't support Mark Zuckerberg.

Telegram is pretty decent. Discord is also great.

 

[ChemicalB]

If you check in the end of the ZDnet link article, you will find a bit deeper explanation from the security researcher Martin Vigo.

Thanks buddy, now it seems more clear and actually the mechanism is simple.So the point of all this is not to use weak passwords.

 

[shmu26]

I'm not a WhatsApp user but I wonder what the attacker would gain or is it more of a prank?

If you are a high-value target, then people want to hack you, and you should worry about this. If you are an anonymous nobody, then the hackers won't waste their time on you, and you should not worry about this.

 

[silversurfer]

Source: WhatsApp fixes bug that let hackers take over app when answering a video call | ZDNet

Bug only affects WhatsApp for Android and iOS, but the issue has been fixed this week.

WhatsApp developers have fixed a bug in the Android and iOS versions of the WhatsApp mobile app that allowed hackers to take over the application when users answered an incoming video call.

 

[Eddie Morra]

I don't like Facebook but I think if there are changes in leadership, they can change and turn over a new leaf. People really do change and so can companies but it all depends on leadership/influence.

Facebook need to look at the bigger picture.

It doesn't have to always be about money... it can be about improving things for the greater good, finding out new things which will benefit all of us in the world, etc. With the resources they have, they can do some great things if they put their mind to it, without it harming other people for their own gain.