A clickjacking vulnerability in WhatsApp that enables phishing attacks

Post by LelouBil » Fri, Dec 22, 2023, 1:47 PM UTC

pera wrote: post #22

Flimm wrote: post #6

It's disappointing that Meta chose not to fix this and chose not to reward this researcher with a bug bounty.

I reported a similar issue to Google early this year and they declined the submission because it "can only result from social engineering" and "we think that addressing it would not make our users significantly less vulnerable". I won't mention the details here but Google Search sometimes rewrite URLs in such way that an attacker can spoof the actual URL. My advice is to never trust URLs displayed by websites and app…

Post by LelouBil » Fri, Dec 22, 2023, 1:49 PM UTC

isaacfrond wrote: post #27

ajb wrote: post #14

Earlier quoted context omitted.

The article says "I decided to intercept a message via WA web".

That was the initial idea, but it failed because Whatsapp traffic is end to end encrytped. The second idea, which actually worked, was to put a breakpoint in Whatsapp while running in an emulator.

Post by Zu_ » Fri, Dec 22, 2023, 1:55 PM UTC

AlecSchueler wrote: post #34

acdha wrote: post #16

Earlier quoted context omitted.

That’s still a Meta problem. Simply confirming the PoC should have made it clear that they need to fix something.

POC?

Post by cyann » Fri, Dec 22, 2023, 1:55 PM UTC

AlecSchueler wrote: post #34

acdha wrote: post #16

Earlier quoted context omitted.

That’s still a Meta problem. Simply confirming the PoC should have made it clear that they need to fix something.

POC?

Post by dclowd9901 » Fri, Dec 22, 2023, 1:57 PM UTC

Flimm wrote: post #6

It's disappointing that Meta chose not to fix this and chose not to reward this researcher with a bug bounty.