WhatsApp privacy bug still not fixed says crypto startup that found it

An issue with WhatsApp’s disappearing media feature has finally been fixed, months after it was first discovered by crypto wallet startup Zengo’s technical team.

The View Once feature was introduced by WhatsApp to protect its users’ privacy by allowing them to send pictures and videos that would automatically be wiped once viewed.

However, in August, Zengo’s team discovered that the feature could be “trivially bypassed” when using the platform’s web app. The team says it disclosed the issue to WhatsApp but when it became clear that the issue had already been “exploited in the wild,” it made its findings public “to protect the privacy of WhatsApp’s users.”

WhatsApp responded with a quick patch but this reportedly still allowed the supposedly deleted images to be viewed. Now, the messaging platform says, it’s rolled out a more comprehensive software update.

Zengo detailed its discovery of the problem in a lengthy blog post in September.

“As we continue to develop the world’s pioneering MPC crypto wallet, the Zengo X Research Team is looking into its closest-living relative, the Instant Messaging (IM) apps domain,” wrote Zengo Co-Founder Tal Be’ery. “As a result of such research, we were able to identify and report important privacy issues in the past.”

He added, “When we looked into the implementation details we were very surprised to find that although ‘View Once’ is meant to be limited to platforms in which the app can control its displayed content and prevent other processes from abusing it, it is not enforced by WhatsApp’s API server.

“As a result, a client on any platform can download the message and make the ‘View Once’ promise void.

Be’ery then described how his team built its own unofficial WhatsApp client based on an open-source implementation of WhatsApp’s web client and informed Meta.

Read more: Bybit CEO claims Chinese users can bypass restrictions with VPN

Zengo says fix is better but still not perfect

In another blog post from Monday, Be’ery explained how even though the fix is “a great improvement with respect to the original starting point,” it’s not perfect.

“This fix indeed solves the core issue: Recipient’s devices that should not display a View Once message do not get it,” he writes.

“As a result, a trivial exploitation with a modified WhatsApp Web client cannot work.”

However, he adds, “The fix still allows other sender’s devices that should not display a View Once message to get it. This may pose an unnecessary risk as it increases the attack surface for no reason, since these messages are not displayed on such devices.

“For example, a View Once message might be forensically extracted from these devices by attackers.”

Source