A Bug Can Lead to WhatsApp Group Chat Crash, Here’s How

A new vulnerability in WhatsApp that could allow a bad actor to deliver a malicious group chat message that would crash the app for all members of the group was discovered and mitigated by Check Point Research. To regain use of the free messaging platform, users would need to uninstall and reinstall it, then delete the group which contains the message.

Oded Vanunu, Check Point’s head of product vulnerability research said: “Because WhatsApp is one of the world’s leading communication channels for consumers, businesses and government agencies, the ability to stop people using the app and delete valuable information from group chats is a powerful weapon for bad actors. All users should update to the latest version of the app to protect themselves against this possible attack.”

Check Point Research disclosed its findings to the WhatsApp bug bounty program on 28 August 2019. The Facebook owned platform acknowledged the findings and developed a fix to resolve the issue, which is available since the app's version number 2.19.58.

“WhatsApp greatly values the work of the technology community to help us maintain strong security for our users globally,” said WhatsApp Software Engineer Ehren Kret. “Thanks to the responsible submission from Check Point to our bug bounty program, we quickly resolved this issue for all WhatsApp apps in mid-September. We have also recently added new controls to prevent people from being added to unwanted groups to avoid communication with untrusted parties all together.”

How the Bug Crashes WhatsApp Group Chat

To create the malicious message that would impact a WhatsApp group, the bad actor would need to be a member of the target group (The app allows up to 256 users per group). From there, the bad actor would need to use the app's Web and their web browser’s debugging tool to edit specific message parameters and send the edited text to the group.

This edited message would cause a crash loop for group members, denying users access to all WhatsApp functions until they reinstall the app and delete the group with the malicious message.

The Check Point Research team found the vulnerability by inspecting the communications between WhatsApp and the web version of the app, which mirrors all messages sent and received from the user’s phone.

This enabled researchers to see the parameters used for WhatsApp communications and manipulate them. This new research builds on the 'FakesApp' flaws discovered by Check Point Research, which allowed group chat messages to be edited to spread fake news. WhatsApp has 1.5 billion users and more than a billion groups, making it the most popular instant messaging app worldwide with over 65 billion messages each day.