WhatsApp security Flaw leaves User Location Vulnerable to Hackers
According to Researchers at UNH Cyber Forensics Research & Education Group, WhatsApp location sharing service could expose your location to hackers or Spy Agencies. While sharing the location on WhatsApp users need to first locate themselves on Google Map within the app window .
Once selected, WhatsApp fetches the location and thumbnail (an image) from the Google Map service to share it as the message icon, but unfortunately WhatsApp downloads this image through an unencrypted channel from Google that could be sniffed during a Man-in-the-middle attack, as shown in the video demo.
[adsense size='1']
“The main issue is that the location image is unencrypted, leaving it open for interception through either a Rouge AP, or any man-in-the middle attacks,” the reports read.
"We were not able to intercept the image until the message was sent from the phone, indicating that the download of the image did not occur until the message was actually sent." researcher said.The captured image could be enough to expose your nearby location, but practically this attack is only possible when attacker and the victim are connected to the same network in order to facilitate the MITM attacks.
Such short-range dependency makes this vulnerability of very low severity level for normal attackers, but spy agencies like NSA or GCHQ, those are capable to perform large scale MITM attacks, could exploit this flaw to trace users’ location nation-wide.
Gloss