Any Android app can read your WhatsApp database

I thought the way android apps can lock down information away from other apps is they are able to set permission bits to be for their own unix "user" (e.g. each app gets their own userid). It's conceivable that WhatsApp simply set the permissions to be too open.

Re: Any Android app can read your WhatsApp database

#5

Post by izacus » Tue, Mar 11, 2014, 4:31 PM UTC

Storing critical data to external storage (which is clearly explained as unsecure in http://developer.android.com/guide/topics/data/data-storage....) is a huge security hole. This kind of basic oversight makes me wonder about base competence of WhatsApp developers - anyone with basic understanding of the OS would get that anyone can read external storage.

Re: Any Android app can read your WhatsApp database

#6

Post by anoncow » Tue, Mar 11, 2014, 4:31 PM UTC

Does this happen on Windows Phone devices as well? While WP allows reading and writing to the SD card, it provides isolated storage for apps(which is a source of much pain). While I am not sure about how android handles storage for apps, there should be a middle ground where users can explicitly permit apps to read protected storage data of other apps. WP disallows storage data sharing between apps leading to limited functionality.(this is not related to the article, just a wp rant)

Re: Any Android app can read your WhatsApp database

#7

Post by izacus » Tue, Mar 11, 2014, 4:33 PM UTC

kzahel wrote: post #4

I thought the way android apps can lock down information away from other apps is they are able to set permission bits to be for their own unix "user" (e.g. each app gets their own userid). It's conceivable that WhatsApp simply set the permissions to be too open.

Em, no - that can only be done in internal store "data" directories which are usually formatted with UNIX filesystems and are by default secure (and cannot be accessed by other apps at all).

WhatsApp is storing to external (on most devices FAT) storage (which was SD card on older devices, it's usually a separate directory/partition on newer ones) which does not have any ACL-like system due to FAT backwards compatibility.

Re: Any Android app can read your WhatsApp database

#8

Post by [deleted] » Tue, Mar 11, 2014, 4:34 PM UTC

[deleted]

Re: Any Android app can read your WhatsApp database

#9

Post by kllrnohj » Tue, Mar 11, 2014, 4:43 PM UTC

Holy shit, the SAME AES key is used for everyone? Good god WhatsApp, what the fuck are you doing?

Re: Any Android app can read your WhatsApp database

#10

Post by DCKing » Tue, Mar 11, 2014, 4:46 PM UTC

izacus wrote: post #5

Storing critical data to external storage (which is clearly explained as unsecure in http://developer.android.com/guide/topics/data/data-storage.... ) is a huge security hole. This kind of basic oversight makes me wonder about base competence of WhatsApp developers - anyone with basic understanding of the OS would get that anyone can read external storage.

You are absolutely right.

Still, I think Google is taking the wrong approach: the insecure /sdcard partition is the place where most of the storage is in nearly all Android phones. If your app needs to store larger amounts of data, that is the place to do it. Now, there are methods to use that storage a lot more securely than this, but the way Android works really leaves developers no other option than storing this stuff on the SD card.

Google should lock down access to the SD card even more, but they'll probably cause an uproar and break many apps.