Security researchers have uncovered a vulnerability in WhatsApp that was so bad it could have been exploited to send malicious messages to permanently crash the app for whole groups of users.
The problem deals with a communication protocol in the app for group chats. Security firm Check Point discovered it could trigger a "crash looping" error by crafting a message that's been designed to re-write the parameters in the protocol's computer code.
"In order to exploit this bug we would need to replace the participant's parameter from the sender phone number to any non-digit character(s) e.g. '[email protected].whatsapp.net,'" Check Point security researchers wrote in a Tuesday report.
That small change can cause mayhem for every member of a group chat. "The bug will crash the app and it will continue to crash even after we reopen WhatsApp, resulting in a crash loop. Moreover, the user will not be able to return to the group and all the data that was written and shared in the group is now gone for good," the researchers added.
To restore functionality, users would have to remove and re-install WhatsApp on their phone and then delete the affected group chat, resulting in a loss of whatever content was hosted inside.
"Because WhatsApp is one of the world's leading communication channels for consumers, businesses and government agencies, the ability to stop people using WhatsApp and delete valuable information from group chats is a powerful weapon for bad actors," Oded Vanunu, Check Point's head of product vulnerability research, said in a statement.
The good news is that WhatsApp patched the flaw in September with version 2.19.246. The current version of WhatsApp is now 2.19.362, so most, if not all users, should be protected from the bug through automatic updates.
The vulnerability, which only affected group chats, also isn't easy to exploit. Check Point only discovered the flaw in August while inspecting communications between the web-based version of WhatsApp and the mobile version of the app. This requires extensive coding skills to pull off, which is why WhatsApp is calling the vulnerability a "theoretical" threat that is unlikely to happen in real life.
"Thanks to the responsible submission from Check Point to our bug bounty program, we quickly resolved this issue for all WhatsApp apps in mid-September," WhatsApp told PCMag. "We have also recently added new controls to prevent people from being added to unwanted groups to avoid communication with untrusted parties all together."
There's currently no evidence malicious hackers ever discovered and abused the bug. However, WhatsApp has increasingly become a major target for cyberspies. In May, the app disclosed a separate vulnerability that an Israeli spyware firm was allegedly using to spy on at least 1,400 people across the world.