Connecting to LinkedIn...

W1siziisijiwmtuvmdqvmtuvmdgvntqvmzgvnzi1l01ptlrbu0hfqkxpr19vtljftkrfukvex0lnqudfx3jlc2l6zwrfyw5kx3jlbmrlcmvklmpwzyjdlfsiccisinrodw1iiiwimtkymhgxmjuwiyjdxq

Blog

WhatsApp conversations can be stolen on Android devices

13/03/2014 by

W1siziisijiwmtqvmtavmjgvmtuvndgvmzivmtc2l2zpbguixsxbinailcj0ahvtyiisijywmhg0mdbcdtawm2uixv0

A Dutch researcher published a proof of concepton Tuesday that shows how a malicious application can be used to steal WhatsApp conversations on Android devices – which is particularly disconcerting considering a reported 400 million people use the cross-platform instant messaging service each month.

In this instance, the WhatsApp database being stored to the Android device’s SD card can be accessed by another app, so long as the user allows it, according to a blog post by Bas Bosschert. The root of the problem lies in the Android Application Sandbox, which is meant to isolate app data and code execution.

In his proof of concept, Bosschert created an app that can access the SD card and can be used to upload the WhatsApp databases to a web server he established. The app displays a loading screen during the WhatsApp database upload, ultimately tricking users into thinking something is going on in the background.

“The WhatsApp database is a SQLite3 database which can be converted to Excel for easier access,” Bosschert wrote. “Lately WhatsApp is using encryption to encrypt the database, so it can no longer be opened by SQLite. But we can simply decrypt this database using a simple python script. This script converts the crypted database to a plain SQLite3 database (got key from Whatsapp Xtract).”

On Monday, WhatsApp – which was acquired by Facebook in February for $19 billion – launched an update for its app, but this issue still persists, according to Bosschert.

“I think this is a significant issue since it shows how poor security and programming practices can affect all of us as users, even when there is no malicious intent,” Domingo Guerra, president and founder of Appthority, said.

This article has been extracted from http://www.scmagazine.com/, please click on this link to read the article in full http://www.scmagazine.com/whatsapp-conversations-can-be-stolen-on-android-devices/article/338015/

Montash is a multi-award winning , global IT recruitment firm. Specialising in permanent and contract positions across mid-senior appointments across a wide range of industry sectors and IT functions including:

ERP, BI & Data, Information Security, IT Architecture & Strategy, Scientific Technologies, Demand IT and Business Engagement, Digital and E-commerce, Infrastructure and Service Delivery, Project and Programme Delivery.

For more information please contact us on +44 (0) 20 7014 0230 or alternatively send us an email on info@montash.com.

comments powered by Disqus

Social Stream

Latest News

W1siziisijiwmtcvmdkvmjkvmdgvmtmvmjkvmjgyl1vudgl0bgvkigrlc2lnbiaomjuplmpwzyjdlfsiccisinrodw1iiiwimzgwedewmcmixv0

Are PSLs a Blocker or an Enabler?

2017-10-02 11:00:00 +0100

The use of a Preferred Supplier List (PSL) was intended to support and strengthen relationships and performance between organisations and their third party suppliers. As the technical landscape continues to evolve at rapid rate recruitment and demand for new skills becomes more intense. Are PSLs still the solution or an obstacle to sourcing the right talent? The traditional PSL A dedicated list of partners intended to guarantee quality and availability ...

W1siziisijiwmtcvmdkvmjevmdgvndmvmduvmtmxl1vudgl0bgvkigrlc2lnbiaomjmplmpwzyjdlfsiccisinrodw1iiiwimzgwedewmcmixv0

Why do we punish the victims of hacking?

2017-09-21 09:00:00 +0100

Hacks occur every 39 seconds, with 95% of them targeting governments, retailers and the tech industry. If the hackers are caught, they'll face prison time under the Computer Misuse Act. More often than not, the businesses who are victims of those attacks expose themselves to punishment of their own. The laws that determine the duty of protection owed to businesses and their customers is both vague and broad, making them question just how much protection...