From InfoWorld: Bas Bosschert, a self-billed "consultant/sysadmin/entrepreneur," has demonstrated a proof-of-concept exploit that shows how the locally stored message database used by WhatsApp can be read by any other Android application with local access to the file system.
Though the WhatsApp database is supposed to be encrypted to prevent casual snooping, Bosschert found it wasn't difficult to extract the database key with the aid of an existing program and to decrypt the results.
Bosschert's proof of concept involved creating another Android application, which he used for silently siphoning WhatsApp's SQLite database. He then transmitted the results to a remote Web server for further work.
One important aspect of the exploit and a possible mitigating factor: It accesses only copies of the databases placed on the phone's SD card by the program's own backup function. When the database is stored there, even as a backup, it would be accessible to any application that could read the SD card. Android's developer documentation says in no uncertain terms that storing data on an external card is inherently insecure.
To that end, WhatsApp encrypts the backup databases, but Bosschert's exploit works around this as well. For one, the same AES key was used to encrypt the database of every WhatsApp user -- a common encryption no-no. (Bosschert also provided a simple Python script to perform the decryption.)
What's doubly ironic is how the most glaring weaknesses with WhatsApp as exposed by Bosschert are easily solved with good programming practices. Unfortunately, WhatsApp seems to have aimed for the broadest compatibility with its app -- meaning that support for many of the security-enhancing features introduced in Android, including features for external storage, might not have been available to all its users.
This is not the first time WhatsApp has been nailed for insecure programming practices. Back in October 2013, the lead developer of the open source instant messaging program Adium found WhatsApp committed a fundamental error in its cryptography implementation that made it possible to recover the keys used by the program to encrypt message traffic.
In theory, apps that surreptitiously steal information from other apps are banned from the Google Play store, but it can be difficult to police for such programs. The vigilance of users -- such as the Android community on Reddit -- is sometimes the only way to bring these matters to light.
Cryptography is hard to do well, and implementing it properly on an application with as wide a user base as WhatsApp is even harder. The subtle manner in which WhatsApp's data can be not only siphoned off but decrypted ought to serve as a prime cautionary case.
View: Article @ Source Site
