Just a GIF Image Could Have Hacked Your Android Phone Using WhatsApp

Posted by & filed under Security Alerts.

A picture is worth a thousand words, but a GIF is worth a thousand pictures.

Today, the short looping clips, GIFs are everywhere—on your social media, on your message boards, on your chats, helping users perfectly express their emotions, making people laugh, and reliving a highlight.

But what if an innocent-looking GIF greeting with Good morning, Happy Birthday, or Merry Christmas message hacks your smartphone?

Well, not a theoretical idea anymore.

WhatsApp has recently patched a critical security vulnerability in its app for Android, which remained unpatched for at least 3 months after being discovered, and if exploited, could have allowed remote hackers to compromise Android devices and potentially steal files and chat messages.

WhatsApp Remote Code Execution Vulnerability

The vulnerability, tracked as CVE-2019-11932, is a double-free memory corruption bug that doesn’t actually reside in the WhatsApp code itself, but in an open-source GIF image parsing library that WhatsApp uses.

hacking whatsapp account

Discovered by Vietnamese security researcher Pham Hong Nhat in May this year, the issue successfully leads to remote code execution attacks, enabling attackers to execute arbitrary code on targeted devices in the context of WhatsApp with the permissions the app has on the device.

“The payload is executed under WhatsApp context. Therefore it has the permission to read the SDCard and access the WhatsApp message database,” the researcher told The Hacker News in an email interview.

 

“Malicious code will have all the permissions that WhatsApp has, including recording audio, accessing the camera, accessing the file system, as well as WhatsApp’s sandbox storage that includes protected chat database and so on…”

 

How Does WhatsApp RCE Vulnerability Work?

WhatsApp uses the parsing library in question to generate a preview for GIF files when users open their device gallery before sending any media file to their friends or family.

Thus, to be noted, the vulnerability does not get triggered by sending a malicious GIF file to a victim; instead it gets executed when the victim itself simply opens the WhatsApp Gallery Picker while trying to send any media file to someone.

To exploit this issue, all an attacker needs to do is send a specially crafted malicious GIF file to a targeted Android user via any online communication channel and wait for the user to just open the image gallery in WhatsApp.

However, if attackers want to send the GIF file to victims via any messaging platform like WhatsApp or Messenger, they need to send it as a document file rather than media file attachments, because image compression used by these services distorts the malicious payload hidden in images.

As shown in a proof-of-concept video demonstration the researcher shared with The Hacker News, the vulnerability can also be exploited to simply pop-up a reverse shell remotely from the hacked device.

Vulnerable Apps, Devices and Available Patches

The issue affects WhatsApp versions 2.19.230 and older versions running on Android 8.1 and 9.0, but does not work for Android 8.0 and below.

“In the older Android versions, double-free could still be triggered. However, because of the malloc calls by the system after the double-free, the app just crashes before reaching to the point that we could control the PC register,” the researcher writes.

Nhat told The Hacker News that he reported the vulnerability to Facebook, who owns WhatsApp, in late July this year, and the company included a security patch in WhatsApp version 2.19.244, released in September.

Therefore, to protect yourself against any exploit surrounding this vulnerability, you are recommended to update your WhatsApp to the latest version from the Google Play Store as soon as possible.

Besides this, since the flaw resides in an open-source library, it is also possible that any other Android app using the same affected library could also be vulnerable to similar attacks.

The developer of the affected GIF library, called Android GIF Drawable, has also released version 1.2.18 of the software to patch the double-free vulnerability.

WhatsApp for iOS is not affected by this vulnerability.

 

The information contained in this website is for general information purposes only. The information is gathered from The Hacker News while we endeavour to keep the information up to date and correct, we make no representations or warranties of any kind, express or implied, about the completeness, accuracy, reliability, suitability or availability with respect to the website or the information, products, services, or related graphics contained on the website for any purpose. Any reliance you place on such information is therefore strictly at your own risk.  Through this website, you are able to link to other websites which are not under the control of CSIRT-CY. We have no control over the nature, content and availability of those sites. The inclusion of any links does not necessarily imply a recommendation or endorse the views expressed within them. Every effort is made to keep the website up and running smoothly. However, CSIRT-CY takes no responsibility for, and will not be liable for, the website being temporarily unavailable due to technical issues beyond our control.