WhatsApp Photo Filter bug enables hackers to access your data

WhatsApp photo filter feature had a high-severity security vulnerability that could have been exploited by threat actors to send a malicious image to read sensitive data from the app’s memory, which has now since been patched. Tracked as CVE-2020-1910, with a CVSS score of 7.8, is an out-of-bounds read/write vulnerability that arises from applying specific image filters on a rogue image and sending the altered image to an unknowing recipient, allowing an attacker to access valuable data stored in the app’s memory.

 

The vulnerabilities were discovered in WhatsApp for Android versions prior to v2.21.1.13 and WhatsApp Business for Android versions prior to v2.21.1.13.

 

On November 10, 2020, Check Point Research researchers revealed the issue to Whatsapp, claiming that they were able to crash WhatsApp by switching between various photo filters on malicious GIF files. The problem was caused by a photo filter function called “applyFilterIntoBuffer(),” which takes the source photo, applies the user-selected filter, and copies the result into the destination buffer.

 

The researchers discovered that the vulnerable function depended on the assumption that both the source and filtered photos have the same dimensions and RGBA color format after reverse-engineering the “libwhatsapp.so” library.

 

Since each RGBA pixel is saved as 4 bytes, a malicious image with just one byte per pixel can be used to gain an out-of-bounds memory access, because the “function tries to read and copy four times the amount of the allocated source image buffer.”

 

WhatsApp stated that they believe the problem had no effect on users. To prevent unauthorized reads, WhatsApp has added two new checks to the source and filter images in version 2.21.1.13. These checks ensure that both the source and filter images are in RGBA format and that the image has 4 bytes per pixel.

 

 

You might also like:

 

Beware of WhatsApp verification code scam

Chinese company EskyFun exposes over 1 million Android gamers’ data

FMWhatsApp for Android spotted installing Triada trojan

Signal fixed an old bug that sent random images to wrong contacts

 

 

WhatsApp, Facebook, bug, cybersecurity, vulnerability