WhatsApp and Telegram are personal messaging apps that have, between them, more than 1.7 billion users around the world. They are frequently used by political activists, healthcare providers, and businesses around the world because of the security of their "always encrypted" communications. But recent research shows that there are security vulnerabilities that could open the services to manipulation and data theft for users on Android devices.
In a blog post today, Symantec researchers Yair Amit and Alon Gat discussed a media file jacking flaw in the way that the Android apps store files that the user receives. The researchers note that the flaw isn't in the app code, but in the app logic, specifically where the apps will store files that they receive.
"We found the vulnerability in the way on Android that WhatsApp (by default) and Telegram (in a certain setting) can store attachments like photos and audio messages before the user is able to open the original file," says Domingo Guerra, senior director of modern OS security at Symantec.
The trouble is that Android can store files in two locations — internal and external storage. Data in internal storage can only be accessed by the app that stored it. Data in external storage is defined as world readable and writeable — any app or user can read and modify the data.
WhatsApp stores received media files in external storage by default. Telegram uses external storage for its "Save to Gallery" feature. In both cases, the files are stored to publicly accessible directories.
According to Guerra, there are several kinds of damage that could result from the ability to intercept and manipulate files on a ..
Support the originator by clicking the read the rest link below.
