Hackers Can Manipulate Media Files You Receive Via WhatsApp and Telegram

If you think that the media files you receive on your end-to-end encrypted secure messaging apps can not be tampered with, you need to think again.

Security researchers at Symantec yesterday demonstrated multiple interesting attack scenarios against WhatsApp and Telegram Android apps, which could allow malicious actors to spread fake news or scam users into sending payments to wrong accounts.

Dubbed “Media File Jacking,” the attack leverages an already known fact that any app installed on a device can access and rewrite files saved in the external storage, including files saved by other apps installed on the same device.

WhatsApp and Telegram allow users to choose if they want to save all incoming multimedia files on internal or external storage of their device.

However, WhatsApp for Android by default automatically stores media files in the external storage, while Telegram for Android uses internal storage to store users files that are not accessible to any other app.

But, many Telegram users manually change this setting to external storage, using “Save to Gallery” option in the settings, when they want to re-share received media files with their friends using other communication apps like Gmail, Facebook Messenger or WhatsApp.

It should be noted that the attack is not just limited to WhatsApp and Telegram, and affects the functionality and privacy of many other Android apps as well.

How Does “Media File Jacking” Attack Work?

Just like man-in-the-disk attacks, a malicious app installed on a recipient’s device can intercept and manipulate media files, such as private photos, documents, or videos, sent between users through the device’s external storage—all without the recipients’ knowledge and in real-time.

“The fact that files are stored in, and loaded from, external storage without proper security mechanisms, allows other apps with write-to-external storage permission to risk the integrity of the media files,” researchers said in a blog post.

“Attackers could take advantage of the relations of trust between a sender and a receiver when using these IM apps for personal gain or wreaking havoc.”

Researchers illustrated and demonstrated four attack scenarios, as explained below, where a malware app can instantaneously analyze and manipulate incoming files, leading to:

1.) Image manipulation

For more, click here.