Flaws in WhatsApp, Telegram Allow Hackers to Alter Files

Researchers from Symantec disclosed flaws in WhatsApp and Telegram messaging apps that could allow potential hackers to alter images and audio files.

While the sender might have sent a photo of a map, malware could exploit this vulnerability on WhatsApp and Telegram to replace the photo and give the recipient the wrong directions, for example. In another example, the malware could change numbers in a photo of an invoice, to scam victims into giving money to the wrong person, CNET reported.

Secure messaging apps are an important tool for activists, politicians and dissidents who want to keep their conversations protected from surveillance. Messaging apps like Signal, WhatsApp, Telegram and iMessage have end-to-end encryption, which means that the conversations are hidden even from the companies themselves.

While the encryption protects your messages from surveillance, it doesn't mean that the apps themselves are immune. In May, reports disclosed a WhatsApp flaw that allowed hackers to install spyware on devices with a simple phone call. Security researchers also disclosed a Telegram vulnerability in 2017 that allowed hackers to take over accounts.

The new vulnerability disclosed on Monday doesn't allow for account hijacking, but it was ripe for fraud, Symantec's researchers said.

The security flaw stemmed from how media files are stored on WhatsApp and Telegram, Symantec said in a blog post. When files are stored on external storage, other apps can access and manipulate them. On WhatsApp, files are stored externally by default, while on Telegram, the vulnerability is present if "Save to Gallery" is enabled.

Symantec's researchers tested malware it created to manipulate image and audio files sent through WhatsApp and Telegram. In a demo clip, a person sent a photo of two friends, and the malware on the recipient's device automatically replaced it with the actor Nicolas Cage over their faces.

WhatsApp and Telegram did not respond to a request for comment.

If you're using these apps, you can protect yourself from this risk by changing your settings for media storage. On WhatsApp, you can do this by going to settings, and toggling off "Media Visibility." On Telegram, you can protect yourself by toggling off "Save to Gallery."

An imposter Telegram

Symantec's researchers also discovered a separate issue with Telegram, with a fake version of the app on the Google Play Store.

The app, called MobonoGram, promoted itself as an enhanced version of Telegram with extra features. That would be true, if the extra features meant visiting malicious websites like pornography and scams in the background. This malware would also slow down users' devices and drain its battery life.

The fraudulent app was downloaded more than 100,000 times before it was removed from the Google Play store. Google confirmed it was removed and said it banned the developers.

Researchers found another imposter app that served the same attacks called Whatsgram, by the same developers. Symantec said it's blocked more than 1,200 apps related to these developers from January to May, with most infections happening in the US, Iran and India.