German researchers have found a way to infiltrate any WhatsApp chat group, although it is not something available to everyone: it is necessary to have access to the WhatsApp servers.
Once you have access to the server it is possible inject anyone into a group chat, that is, self-invite. Once inside, the intruder obtains the encryption keys of each of the members, with which he can decrypt all the following messages that are exchanged in the group.
The attacker is another member of the group
WhatsApp introduced end-to-end encryption in all its conversations in 2016, the main advantage of this system being that not even from the server side you can know the content of the messages.
This vulnerability found by researchers at the Ruhr University of Bochum undermines the previous principle, as it is possible for someone with access to the server take the necessary steps to access the content of a group chat.
What is not clear is how easy it is to infiltrate servers WhatsApp: an exclusive territory of Facebook workers, governments demanding access and, of course, hackers.
The culprit, the links to join groups
Hiding in the “but”, that is, the need to have access to WhatsApp servers, Alex Stamos, Head of Facebok Security, has minimized the study in this twitter thread, giving some interesting key points.
For example, the rest of the users in the group would see the message “X person has joined the group“which should alert them to the intrusion. The way to tackle this problem would be to completely disable web links to join a group or change the way they work.
In short, yes, an attacker with access to a WhatsApp server could invite himself to any chat group and read future messages (not past ones), but the rest of the group members would receive a notice that someone has joined.
Via | The Verge
In Engadget Android | WhatsApp for Android now allows you to use links to join groups