WhatsApp privacy bug still not fixed says crypto startup that found it

  protos.com 58 m

WhatsApp privacy bug still not fixed says crypto startup that found it

An issue with WhatsApp’s disappearing media feature has finally been fixed, months after it was first discovered by crypto wallet startup Zengo’s technical team.

The View Once feature was introduced by WhatsApp to protect its users’ privacy by allowing them to send pictures and videos that would automatically be wiped once viewed.

However, in August, Zengo’s team discovered that the feature could be “trivially bypassed” when using the platform’s web app. The team says it disclosed the issue to WhatsApp but when it became clear that the issue had already been “exploited in the wild,” it made its findings public “to protect the privacy of WhatsApp’s users.”

WhatsApp responded with a quick patch but this reportedly still allowed the supposedly deleted images to be viewed. Now, the messaging platform says, it’s rolled out a more comprehensive software update.

Zengo detailed its discovery of the problem in a lengthy blog post in September.

“As we continue to develop the world’s pioneering MPC crypto wallet, the Zengo X Research Team is looking into its closest-living relative, the Instant Messaging (IM) apps domain,” wrote Zengo Co-Founder Tal Be’ery. “As a result of such research, we were able to identify and report important privacy issues in the past.”

He added, “When we looked into the implementation details we were very surprised to find that although ‘View Once’ is meant to be limited to platforms in which the app can control its displayed content and prevent other processes from abusing it, it is not enforced by WhatsApp’s API server.

“As a result, a client on any platform can download the message and make the ‘View Once’ promise void.

Be’ery then described how his team built its own unofficial WhatsApp client based on an open-source implementation of WhatsApp’s web client and informed Meta.