Cybersecurity News in Asia

RECENT STORIES:

SEGA moves faster with flow-based network monitoring
New Akamai Study Reveals API Security Incidents Cost APAC Enterprises ...
Synthetic fraud is escalating: identity intelligence in SEA requires o...
One cybersecurity firm reports a slight decline in ransomware attacks ...
Backups are not enough for cyber resilience
23% of HTML email attachments are malicious
LOGIN REGISTER
CybersecAsia
  • Conference 2025
  • Features
    • Featured

      Backups are not enough for cyber resilience

      Backups are not enough for cyber resilience

      Monday, May 5, 2025, 4:49 PM Asia/Singapore | Features
    • Featured

      MSPs the first line of defense for APAC SMEs

      MSPs the first line of defense for APAC SMEs

      Tuesday, April 15, 2025, 1:30 PM Asia/Singapore | Features
    • Featured

      Are Singaporeans ready to handle deepfakes and disinformation in the 2025 general elections?

      Are Singaporeans ready to handle deepfakes and disinformation in the 2025 general elections?

      Wednesday, April 9, 2025, 5:03 PM Asia/Singapore | Features, Newsletter
  • Opinions
  • Tips
  • Whitepapers
  • Awards 2024
  • Directory
  • E-Learning

Select Page

LOGIN REGISTER
  • Conference 2025
  • Features
    • Featured

      Backups are not enough for cyber resilience

      Backups are not enough for cyber resilience

      Monday, May 5, 2025, 4:49 PM Asia/Singapore | Features
    • Featured

      MSPs the first line of defense for APAC SMEs

      MSPs the first line of defense for APAC SMEs

      Tuesday, April 15, 2025, 1:30 PM Asia/Singapore | Features
    • Featured

      Are Singaporeans ready to handle deepfakes and disinformation in the 2025 general elections?

      Are Singaporeans ready to handle deepfakes and disinformation in the 2025 general elections?

      Wednesday, April 9, 2025, 5:03 PM Asia/Singapore | Features, Newsletter
  • Opinions
  • Tips
  • Whitepapers
  • Awards 2024
  • Directory
  • E-Learning
Most Read1News

WhatsApp group chat vulnerability hack thwarted

By CybersecAsia editors | Wednesday, December 18, 2019, 1:56 PM Asia/Singapore

WhatsApp group chat vulnerability hack thwarted

Researchers had discovered in August a group-chat flaw where a malicious message could crash WhatsApp group users’ devices.

A vulnerability in WhatsApp was recently identified, that could allow a bad actor to deliver a malicious group chat message that would crash the app for all members of the group. To regain use of WhatsApp, users would need to uninstall and reinstall it, then delete the group which contains the message.

The vulnerability was discovered by Check Point Research, the Threat Intelligence arm of Check Point Software Technologies.

To create the malicious message that would impact a WhatsApp group, the bad actor would need to be a member of the target group (WhatsApp allows up to 256 users per group). From there, the bad actor would need to use WhatsApp Web and their web browser’s debugging tool to edit specific message parameters and send the edited text to the group. This edited message would cause a crash loop for group members, denying users access to all WhatsApp functions until they reinstall WhatsApp and delete the group with the malicious message.

Oded Vanunu, Check Point’s Head of Product Vulnerability Research said: “Because WhatsApp is one of the world’s leading communication channels for consumers, businesses and government agencies, the ability to stop people using WhatsApp and delete valuable information from group chats is a powerful weapon for bad actors. All WhatsApp users should update to the latest version of the app to protect themselves against this possible attack.”  

Check Point Research responsibly disclosed its findings to the WhatsApp bug bounty program on August 28th, 2019. WhatsApp acknowledged the findings and developed a fix to resolve the issue, which has been available since WhatsApp version number 2.19.58.  Users should manually apply on their devices. “WhatsApp responded quickly and responsibly to deploy the mitigation against exploitation of this vulnerability,” said Oded Vanunu. 

Said WhatsApp Software Engineer Ehren Kret: “WhatsApp greatly values the work of the technology community to help us maintain strong security for our users globally. Thanks to the responsible submission from Check Point to our bug bounty program, we quickly resolved this issue for all WhatsApp apps in mid-September. We have also recently added new controls to prevent people from being added to unwanted groups to avoid communication with untrusted parties all together.”  

The Check Point Research team found the vulnerability by inspecting the communications between WhatsApp and WhatsApp Web, the web version of the app which mirrors all messages sent and received from the user’s phone. This enabled researchers to see the parameters used for WhatsApp communications and manipulate them. This new research builds on the ‘FakesApp’ flaws discovered by Check Point Research, which allowed group chat messages to be edited to spread fake news.  

WhatsApp has 1.5 billion users and more than a billion groups, making it the most popular instant messaging app worldwide. Over 65 billion messages are sent via WhatsApp per day.

Watch the demo video of how the attack works, and read the full technical details in the research report here.

Share:

PreviousAndroid users: Watch out for the xHelper mobile trojan
NextHigh demand for training in data protection

Related Posts

Are brand phishing tactics trending towards social/career-oriented networks?

Are brand phishing tactics trending towards social/career-oriented networks?

Wednesday, May 4, 2022

Inability to authenticate customers is causing mounting losses to Indonesian businesses

Inability to authenticate customers is causing mounting losses to Indonesian businesses

Monday, March 16, 2020

Rising use of deepfakes, fake identities will require better identity-authentication tech: research

Rising use of deepfakes, fake identities will require better identity-authentication tech: research

Thursday, September 1, 2022

In Turkey, your fingers’ veins can now be used as your biometric identity

In Turkey, your fingers’ veins can now be used as your biometric identity

Wednesday, October 7, 2020

Leave a reply Cancel reply

You must be logged in to post a comment.

Voters-draw/RCA-Sponsors

Slide
Slide
Slide
Slide
Slide
Slide
Slide
Slide
Slide
Slide
Slide
Slide
Slide
Slide
Slide
Slide
Slide
previous arrow
next arrow

CybersecAsia Voting Placement

Gamification listing or Participate Now

PARTICIPATE NOW

Vote Now -Placement(Google Ads)

Top-Sidebar-banner

Whitepapers

  • 2024 Insider Threat Report: Trends, Challenges, and Solutions

    2024 Insider Threat Report: Trends, Challenges, and Solutions

    Insider threats continue to be a major cybersecurity risk in 2024. Explore more insights on …Download Whitepaper
  • AI-Powered Cyber Ops: Redefining Cloud Security for 2025

    AI-Powered Cyber Ops: Redefining Cloud Security for 2025

    The future of cybersecurity is a perfect storm: AI-driven attacks, cloud expansion, and the convergence …Download Whitepaper
  • Data Management in the Age of Cloud and AI

    Data Management in the Age of Cloud and AI

    In today’s Asia Pacific business environment, organizations are leaning on hybrid multi-cloud infrastructures and advanced …Download Whitepaper
  • Mitigating Ransomware Risks with GRC Automation

    Mitigating Ransomware Risks with GRC Automation

    In today’s landscape, ransomware attacks pose significant threats to organizations of all sizes, with increasing …Download Whitepaper

Middle-sidebar-banner

Case Studies

  • St Luke’s ElderCare enhances operations and capabilities through a centralized secure, scalable network

    St Luke’s ElderCare enhances operations and capabilities through a centralized secure, scalable network

    With only a small IT team, the digital transformation has united operations across 30 locations, …Read more
  • Automating border control and security with facial recognition technology

    Automating border control and security with facial recognition technology

    Indonesia Immigration & Seaport Authorities enhances security and speeds up border control queues at Batam …Read more
  • Securing wealth advisory services without unnecessary friction: Endowus

    Securing wealth advisory services without unnecessary friction: Endowus

    The wealth advisory platform demonstrates its non-negotiable commitment to a robust security posture through partnering …Read more
  • LifeTech group sets up next-gen security operations center in Malaysia

    LifeTech group sets up next-gen security operations center in Malaysia

    By partnering with a unified cybersecurity platform, the firm will be offering cost-effective advanced SOC …Read more

Bottom sidebar

  • Our Brands
  • DigiconAsia
  • MartechAsia
  • Home
  • About Us
  • Contact Us
  • Sitemap
  • Privacy & Cookies
  • Terms of Use
  • Advertising & Reprint Policy
  • Media Kit
  • Subscribe
  • Manage Subscriptions
  • Newsletter

Copyright © 2025 CybersecAsia All Rights Reserved.