A web server vulnerability could have let hackers hijack the accounts of Telegram and WhatsApp users, security experts disclosed on Wednesday.
The messaging services are popular for their security features, including end-to-end encryption that protects data sent via their smartphone apps. But that end-to-end encryption may have actually made the web versions of Telegram and WhatsApp more vulnerable, according to researchers from Check Point Security, making it relatively easy for hackers to access personal data.
The loophole, which has since been fixed, involved the file-upload tools on the websites of both services. By uploading a malicious document (and, in WhatsApp's case, disguising it with a legitimate preview image), Check Point researchers were able to bypass security safeguards and gain access to the services' user data.
"Since messages were encrypted without being validated first, WhatsApp and Telegram were blind to the content, thus making them unable to prevent malicious content from being sent," Check Point researchers wrote in a blog post. No hacks are believed to have used this loophole, although Check Point said the danger was very real.
"This vulnerability, if exploited, would have allowed attackers to completely take over users' accounts on any browser, and access victims' personal and group conversations, photos, videos and other shared files, contact lists, and more," the researchers wrote. "This means that attackers could potentially download your photos and or post them online, send messages on your behalf, demand ransom, and even take over your friends' accounts."
Check Point said it disclosed the loophole to WhatsApp's and Telegram's security teams on March 7, and both companies acknowledged the issue and have since developed a fix for their web clients.
That fix is relatively simple: both services now validate files attached to messages before they're encrypted. If you send files or messages via the WhatsApp or Telegram websites, all you need to do is make sure that you restart your browser to make sure they're accessing the latest version of the services' web clients.
Telegram downplayed the threat in a blog post, explaining that the vulnerability only applied to malicious videos viewed on its site in the Chrome web browser. The company wrote that "the attack against Telegram required very special conditions and very unusual actions from the targeted user to succeed."
Security experts have questioned Telegram's protections before, including in 2015, when unencrypted copies of the messages sent using the app's Secret Chat tool were found on Android devices.