Unreported WhatsApp Bug
WhatsApp Privacy Bug

Unreported WhatsApp Bug

Venkatesh S. Venkatesh S.

Venkatesh S.

Making AI Accessible for Digital Safety

发布日期: 2017年12月9日
+ 关注

Since the starting of mobile-era, I'm very much clear that there is no such word called privacy.

Due to which - I'm always interested to see what mobile apps are doing behind me.

Sometime back around three years ago - started a traffic monitoring all my PII at the lab environment which looks into all mobile traffic.

Guess what? It's WhatsApp passing my mobile number over unencrypted channel ..couldn't believe what I just saw. The next day, I went to my office started ARP poisoning and exploring traffic and yes it is.

Android version of WhatsApp passes mobile number in TCP traffic which was on clear text protocol.

No alt text provided for this image

What next? - Got a crazy idea :-)

Idea - ARP poison, extract numbers, lookup on truecaller using automated bash script & use yowsup python to greet people :-)

Truecaller Bash

No alt text provided for this image

Not that hard isn't? - Started working on it and now its time for fun .. that too in the airport - Hyderabad :-)

Message - "How are you? Hope you doing good? I just came to know that you are traveling - happy journey."

I got some really interesting replies :-)

Lessons learned

  1. Don't expect privacy from free apps.
  2. Don't connect to public WiFi
  3. Many bad people around you :-)

Interested to explore scripts I've used and PCAP captures?

Laura V.

7 年

there is no such thing as "free apps" anymore! we all pay with data! that's the most valuable asset we have on internet!

赞
回复
1 次回应
Antoniy Shumanov

Blockchain Expertise

7 年

You made a mistake. 1. Don't expect privacy from closed source apps

赞
回复
1 次回应
Nirav Parekh

Senior Threat Researcher @ Sophos

7 年

Good one

赞
回复
查看更多评论

要查看或添加评论，请登录

Venkatesh S.的更多文章

  • CyberSecurity Feed Summarisation with Context using AI
    2023年9月7日

    CyberSecurity Feed Summarisation with Context using AI

    One of the challenges faced by security professionals is the need to be abreast of current security trends. However…

    5 条评论
  • Untangle AI Model's Security Assessments
    2023年7月10日

    Untangle AI Model's Security Assessments

    Artificial intelligence (AI) is a rapidly growing field with the potential to revolutionize many aspects of our lives…

    5 条评论
  • ActiveDefense - Hack the Hacker
    2020年8月10日

    ActiveDefense - Hack the Hacker

    It is always interesting to learn about system design and hacking it. And before we move on, my understanding of…

  • Real Vulnerability - Threat Hunter's formula
    2018年10月5日

    Real Vulnerability - Threat Hunter's formula

    The Virus days are gone, even malware authors has no time to waste these days. Now, it's either about wild attacks for…

    4 条评论
  • Vulnerable SMB Protocol - Beyond WannaCry
    2017年5月22日

    Vulnerable SMB Protocol - Beyond WannaCry

    By now everyone in Security domain should've gained enough insights of WannaCry Ransomeware. In this post lets talk…

    3 条评论
  • Thick Client Security Assessment - I
    2017年1月31日

    Thick Client Security Assessment - I

    Now-a-days we see lot of Security Professionals come from application security background and having no idea about…

    14 条评论
  • BlackNurse Attacks - Analysis & Detection
    2016年11月15日

    BlackNurse Attacks - Analysis & Detection

    While spending boring jobless days sitting at home all of sudden I came across "BlackNurse Attack" - Single computer…

    7 条评论

社区洞察

其他会员也浏览了