malware

WhatsApp vulnerability for Spreading Malware

WhatsApp vulnerability for Spreading Malware

A Cross site scripting (XSS) vulnerability in WhatsApp website reported to The Hacker News by Edgard Chammas. WhatsApp is one of the most famous cross-platform mobile messaging app for iPhone, BlackBerry, Android, Windows Phone and Nokia used to send text, video, images, audio b/w Whatsapp users.

Cross-site scripting (XSS) is a type of computer security vulnerability typically found in Web applications, such as web browsers through breaches of browser security, that enables attackers to inject client-side script into Web pages viewed by other users.

Reported vulnerability exist on payment procedure page as shown in above picture. The Sample code given below to demonstrate the vulnerability.

Recently, there has been an increase in web malware and spam activities and such vulnerabilities can be misused by attackers to spread Malwares and rogue applications.

Edgard also demonstrate that How this can be used to trick users to download a fake application (Malware - WhatsApp.apk) from other any evil domain (www.evilwebsite/WhatsApp.apk). in below given example, attacker just using a pop-up window to open fake application download link.

While the official binary is here http://www.whatsapp.com/android/current/WhatsApp.apk

According to reports in 2012 mobile malwares are 50 times increases than previous ever. We request Whatsapp team to fix the vulnerability as soon as possible.

‘VMware’ Cloud Director Vulnerability Allows 100% Takeover of Corporate Server Infrastructures

Latest vCloud Director vulnerability provides RCE (remote code execution) privilege to hackers. Learn how this was made possible and if we have a vCloud Director fix yet.

Latest Zoom Security Issues: 2 Critical Zoom Vulnerabilities Allows Hackers to Access your PC via a Message

Latest Zoom Vulnerability 2020 June introduces 2 critical flaws that allow hackers remote code execution (RCE) through the Zoom chat feature. Learn how it works without any user interaction and what is this Zoom Vulnerability fix.

‘BHIM’ App Data Leak Exposes 7M Indian Users Sensitive Data – Risk of Financial Fraud, Identity Theft

Indian E-Payments/ UPI App ‘BHIM’ data breach includes high value citizen information like copies of Aadhaar Card and PAN Card, Bank and Biometric details, Contact information and more personal data.

Read next