Why You need to Stop using WhatsApp...



If you haven’t heard by now, Facebook just made its biggest move ever, buying the messaging service WhatsApp in a deal worth some $19 billion. That’s 19 times what Facebook paid for Instagram two years ago.
The WhatsApp Service run by the team of just 32 engineers, handles more than 50 Billion messages daily, and approx 385 million active users.
WhatsApp acquisition has also brought out fresh criticism over security for the billions of messages delivered on the platform. Security Researcher at Praetorian Labs identified several SSL-related security issues in WhatsApp application using Project Neptune, a mobile application security testing platform.
"WhatsApp communication between your phone and our server is fully encrypted. We do not store your chat history on our servers. Once delivered successfully to your phone, chat messages are removed from our system." Company said in a blog post.



 But researchers found that WhatsApp is vulnerable to Man-in-theMiddle attack because the app has not enforced SSL pinning and hence user credentials can be easily stolen. SSL pinning prevents the user of the application from being a victim of an attack made by spoofing the SSL certificate. SSL pinning won't prove a great solution is not validated properly.
"WhatsApp does not perform SSL pinning when establishing a trusted connection between the mobile applications and back-end web services. Without SSL pinning enforced, an attacker could man-in-the-middle the connection between the mobile applications and back-end web services. This would allow the attacker to sniff user credentials, session identifiers, or other sensitive information."
WhatsApp is allowing its backend servers to use weak 40-bit and 56-bit encryption schemes, which can be easily cracked using brute force attack. 'This is the kind of stuff the NSA would love,' researchers said.
WhatsApp team has confirmed that they are actively working on adding SSL Pinning to their app, but still that is not enough to protect our privacy.
Facebook and WhatsApp assured that nothing is going to change after the acquisition and WhatsApp will continue to function as an independent service, but is that statement satisfied? May be we can trust Facebook, Google, WhatsApp.. But we really can't trust the U.S. Government  and the Security agencies like the NSA, that don't respect our privacy and freedom of speech.
Mobile messaging apps often used to deliver sensitive data or used for personal and corporate communications, so the data stored by the service provider should be encrypted end-to-end, which is not yet in the case of WhatsApp.
But there are many other free secure chat applications are available like Telegram, Surespot, Threema, TextSecure, RedPhone etc., that you should use to keep your data private and Secure.

Source - The Hacker News

Comments

Post a Comment

Popular posts from this blog

How to transfer apps on Andriod phone-to-phone

Image
Hello guys, here is a way in which you can transfer any file on your android device including apps installed, from on phone/device to another. I would just keep this short, no stress, no worries required. Its easy. Follow the steps below to to transfer apps on Android from phone/device-to-phone/device ; Step 1 - Click the link or go to Google play and download Bluetooth File Transfer Step 2 - After installing it. Turn on your Bluetooth. Step 3 - Look for the Installed Bluetooth File Transfer app, open it Step 4 - While on the interface, click the options button on your Android phone. Step 5 - Go for more, and select "Send applications" We are done! Now you can send application from your android phone or device to another android phone or device
Read more

Here's the Facebook Hacking Tool that Can Really Hack Accounts.

Image
Yes, you heard me right. A newly discovered Facebook hacking tool actually has the capability to hack Facebook account, but YOURS, and not the one you desires to hack. How to Hack Facebook account? How to Hack my Girlfriends Facebook account? My boyfriend is cheating on me, How do I hack his Facebook Account? These are the queries that most of the Internet users search on Google. But Beware! If you come across any Facebook hacking tool that promises you to help you hack your friends Facebook accounts, you may end up downloading a hacking tool that could hack you, instead of them. Dubbed Remtasu, the tool is marketing itself as a Facebook hacking tool but actually is a Windows-based Trojan that has accelerated globally over the past year, and has now capability to disguise itself as an app for accessing people's Facebook account credentials. The tool contains a Keylogger that can capture all your keystrokes and store them in a file that is subsequently sent to...
Read more