Telegram and WhatsApp Web vulnerability to Hijack Accounts (Patched)

[Ink]

WhatsApp Web and Telegram Web demonstration:
-https://youtu.be/UR_i5XSAKrg
-https://youtu.be/26Ih4xTcP-E

The exploitation of this vulnerability starts with the attacker sending an innocent looking file to the victim, which contains malicious code. The file can be modified to contain attractive content to raise the chances a user will open it. Once the user clicks to open it, the malicious file allows the attacker to access WhatsApp’s and Telegram’s local storage, where user data is stored. From that point, the attacker can gain full access to the user’s account and account data. The attacker can then send the malicious file to the all victim’s contacts, opening a dangerous door to a potentially widespread attack over the WhatsApp and Telegram networks.

Since messages were encrypted without being validated first, WhatsApp and Telegram were blind to the content, thus making them unable to prevent malicious content from being sent.

Check Point disclosed this information to WhatsApp’s and Telegram’s security teams on March 7th. Both companies have verified and acknowledged the security issue and developed a fix for web clients worldwide soon after.

WhatsApp and Telegram web users wishing to ensure that they are using the latest version are advised to restart their browser.

Click on source for details.