A vulnerability classified as critical has been found in WhatsApp Messenger 2.8.3 (Messaging Software). Affected is some unknown functionality of the component Encryption. The manipulation with an unknown input leads to a missing encryption vulnerability. CWE is classifying the issue as CWE-311. The product does not encrypt sensitive or critical information before storage or transmission. This is going to have an impact on confidentiality, and integrity.

The weakness was published 09/05/2012 by Sam Granger as not defined posting (Blog). The advisory is shared for download at samgranger.com. The public release happened without coordination with the vendor. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Technical details are unknown but a public exploit is available. The MITRE ATT&CK project declares the attack technique as T1600. If you installed WhatsApp on an Android device for example, your password is likely to be an inverse of your phones IMEI number with an MD5 cryptographic hash thrown on top of it (without salt): md5(strrev('your-imei-goes-here')).

The exploit is shared for download at heise.de. It is declared as proof-of-concept.

The problem might be mitigated by replacing the product with iMessage or SMS as an alternative. Sam Granger suggests in his blog post: "Think twice before you send a private WhatsApp message. Think twice when you receive a messed up WhatsApp message. You don’t know what’s going on in the background."

Further details are available at heise.de.

Productinfo

Type

• Messaging Software

Name

• WhatsApp Messenger

Version

• 2.8.3

License

• free

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion