Vulnerability That Allowed Hackers to Take Over WhatsApp and Telegram Accounts

Re:Vulnerability That Allowed Hackers to Take Over WhatsApp ... by homakov on Wednesday March 15, 2017 @03:26PM (#13878997)

Statement from @durov - http://telegra.ph/Checkpoint-Confusion-NEWS?1

Because both are Web versions, I'd rate Whatsapp one as 6/10 severity and (due to how hard it is to trick the user) Telegram as 3/10.

Don't have stats but given how inconvenient Web versions are, I don't think they are widely used.

[ Parent | on HN ]

Re:Vulnerability That Allowed Hackers to Take Over WhatsApp ... by mkagenius on Wednesday March 15, 2017 @04:27PM (#13879461)

> Statement from @durov - http://telegra.ph/Checkpoint-Confusion-NEWS?1

How is it that the explanation from companies come only after the researchers writes a blog?

Why can't they disclose the bug themselves (if it had been fixed).

[ Parent | on HN ]

Re:Vulnerability That Allowed Hackers to Take Over WhatsApp ... by homakov on Wednesday March 15, 2017 @04:44PM (#13879603)

In Telegram case, the bug is really a minor severity. Unpopular client, hard to phish scenario. It's only in checkmark's interest to overhype the issue.

[ Parent | on HN ]

Re:Vulnerability That Allowed Hackers to Take Over WhatsApp ... by mkagenius on Wednesday March 15, 2017 @05:27PM (#13879954)

I agree but Telegram's tone seem like they are unhackable, and they have checked for all possible scenarios and the mentioned scenario was overlooked as they had left only minor issues overlooked. They will feel the heat when an easy to exploit scenario comes up. I hope they own it properly before researchers publishes it.

[ Parent | on HN ]

Re:Vulnerability That Allowed Hackers to Take Over WhatsApp ... by homakov on Wednesday March 15, 2017 @06:03PM (#13880271)

How would you behave when someone finds hard to exploit XSS in rarely used Web client and tries to hype out yet another "completely hacked" story? I would have same annoyed tone too.

[ Parent | on HN ]

Re:Vulnerability That Allowed Hackers to Take Over WhatsApp ... by mkagenius on Wednesday March 15, 2017 @06:21PM (#13880409)

All this could have been avoided, had Telegram published the blog first. It's a common problem of companies not owning the vulnerabilities found in them and its understandable that they get scared owning them. But when it eventually comes out, they should talk like "yeah, there was silly xss not a big deal as the author said it to be, but yeah its there". That's it. There is no need to say "researcher wants PR" and "researcher is irresponsible".

[ Parent | on HN ]

Re:Vulnerability That Allowed Hackers to Take Over WhatsApp ... by morsch on Wednesday March 15, 2017 @06:44PM (#13880595)

Don't have stats but given how inconvenient Web versions are, I don't think they are widely used.

... said the standalone email program developer, ca 2005. Couldn't find any numbers for Telegram, but in 2015 the number of WhatsApp Web users was reported[1] to be 200 million, which seems like a lot of people. Most of them probably aren't aware a desktop version exists, nor would they care.

[1] http://www.ibtimes.com/whatsapp-web-security-bug-puts-200-mi... in articles about a very similar WhatsApp Web bug, also found by Checkpoint. They don't bother to give a verifiable reference for the 200 million, fwiw.

[ Parent | on HN ]

Re:Vulnerability That Allowed Hackers to Take Over WhatsApp ... by homakov on Wednesday March 15, 2017 @07:01PM (#13880736)

Telegram web doesn't support so called secret chats - good reason to use a native client. No idea about whatsapp.

[ Parent | on HN ]

Re:Vulnerability That Allowed Hackers to Take Over WhatsApp ... by ryanlol on Wednesday March 15, 2017 @10:04PM (#13881783)

Whatsapp web is super difficult to use. It requires your phone to be in your hand every time you start using it, your phone must also remain on and connected to the internet.

[ Parent | on HN ]

Re:Vulnerability That Allowed Hackers to Take Over WhatsApp ... by morsch on Thursday March 16, 2017 @08:07AM (#13884320)

That's incorrect. You need your phone to log in, but you only have to sign in once per browser. (I assume sessions time out at some point. You can also invalidate existing sessions in the app.)

It's correct that the phone does have to be online while you're using it. But at least you don't lose encryption. Somehow, Signal's web-based client manages to do e2e without that requirement; maybe there's a non-technical reason why WhatsApp does it the way they do.

[ Parent | on HN ]

Re:Vulnerability That Allowed Hackers to Take Over WhatsApp ... by zulln on Wednesday March 15, 2017 @03:44PM (#13879141)

I would say more people use WhatsApp Web than Telegram (percent, not absolute numbers). Telegram does have a desktop client, while WhatsApp Web is the only choice if you want to reply to something from your desktop (taken third-parties aside).

[ Parent | on HN ]

Re:Vulnerability That Allowed Hackers to Take Over WhatsApp ... by donatzsky on Wednesday March 15, 2017 @04:33PM (#13879514)

WhatsApp does actually have a desktop client. It's nothing spectacular, but works well enough.

[ Parent | on HN ]

Re:Vulnerability That Allowed Hackers to Take Over WhatsApp ... by homakov on Wednesday March 15, 2017 @03:46PM (#13879163)

Then, I'd up it to 8/10! I use Telegram for macOS, it's much nicer.

[ Parent | on HN ]