,
11 tweets,
6 min read
Read on Twitter
Yesterday, @CheckPointSW published this excellent report about a new malware called "Agent Smith". When I read it something hit me, @WhatsApp is vulnerable to the 2 years old Janus vulnerability! This is huge, WHAT ARE YOU DOING AT WHATSAPP? 1/n research.checkpoint.com/agent-smith-a-…
The Janus vulnerability is a super cool vulnerability found by @Guardsquare. It gives the possibility to the attacker to modify an APK and keep the original signature. You can consider that as the Holy Graal 2/n guardsquare.com/en/blog/new-an…
Two conditions for this attack to be successful:
- The victim's Android version should be between 5.1.1 and 8.0
- Vulnerable application has been signed with APK signature scheme v1
3/n
- The victim's Android version should be between 5.1.1 and 8.0
- Vulnerable application has been signed with APK signature scheme v1
3/n
One exception: If the application has been signed with mixed APK signature schemes (v1 and/or v2 and/or v3), devices with Android 7.0 and newer are not affected 4/n
The smart people at @WhatsApp signed the app with mixed APK signature schemes. They still use the signature scheme v1... As a consequence, WhatsApp is vulnerable to the Janus vulnerability for Android 5.1.1 to Android 6.0.
5/n
5/n
According to the latest Distribution dashboard made by @Google 28,4% of the Android devices has Android 5.1.1 or Android 6.0. Did you realize how many devices are vulnerable WhatsApp team?! What are you waiting? 6/n
To test it, I took an old device with Android 6.0 and added the log "fs0c131y was here" in AppShell. Now every time, I'm starting WhatsApp, I'm seeing my log.
It can be worst than that... 7/n
It can be worst than that... 7/n
As seen in the "Agent Smith" malware, the attacker can switch your application to multidex and so add as much code as he want.
Your app will be signed correctly, in apparence this is the app made by WhatsApp but inside the code is totally different 8/n
Your app will be signed correctly, in apparence this is the app made by WhatsApp but inside the code is totally different 8/n
This kind of behavior is irresponsable, they put in danger the privacy of hundred of thousands. As we saw with the "Agent Smith" this is used by bad actors...
My rant is finished.
My rant is finished.
I spoke a lot about WhatsApp here but a lot of apps are vulnerable: all the @reliancejio apps, @Truecaller, @Xender_App, @SwiftKey, ...
