Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A clickjacking vulnerability in WhatsApp that enables phishing attacks

00xbyte.github.io

Post reply on HN
Print view View original

11–20 of 84 posts

Re: A clickjacking vulnerability in WhatsApp that enables phishing attacks

#11

Post by IshKebab »

Flimm wrote: post #6

It's disappointing that Meta chose not to fix this and chose not to reward this researcher with a bug bounty.

I expect they probably didn't make clear exactly what they wanted fixed (blacklisting the RTL character) and Meta thought they wanted all misleading URLs fixed which is not really possible.

Re: A clickjacking vulnerability in WhatsApp that enables phishing attacks

#12

Post by aeonik »

Very cool attack, and easy to read write up.

I have one basic question: It was mentioned that attacking the encryption was skipped in favor of using a debugger.

Was this debugger applied to the WhatsApp Web app? Or was the debugger deployed on the phone? Was it an emulator?

For some reason I didn't think WhatsApp had a web app (I don't use it).

Re: A clickjacking vulnerability in WhatsApp that enables phishing attacks

#14

Post by ajb »

aeonik wrote: post #12

Very cool attack, and easy to read write up. I have one basic question: It was mentioned that attacking the encryption was skipped in favor of using a debugger. Was this debugger applied to the WhatsApp Web app? Or was the debugger deployed on the phone? Was it an emulator? For some reason I didn't think WhatsApp had a web app (I don't use it).

The article says "I decided to intercept a message via WA web".

Re: A clickjacking vulnerability in WhatsApp that enables phishing attacks

#16

Post by acdha »

IshKebab wrote: post #11
Flimm wrote: post #6

It's disappointing that Meta chose not to fix this and chose not to reward this researcher with a bug bounty.

I expect they probably didn't make clear exactly what they wanted fixed (blacklisting the RTL character) and Meta thought they wanted all misleading URLs fixed which is not really possible.

That’s still a Meta problem. Simply confirming the PoC should have made it clear that they need to fix something.

Re: A clickjacking vulnerability in WhatsApp that enables phishing attacks

#17

Post by acdha »

tambourine_man wrote: post #7

Nice hack. The real problem is not WhatsApp or the Unicode reverse character, though, it’s that URLs are hard. Just this simple visa.securesite.com fools a lot of people. And I don’t see a good solution in the near future.

This specific example is poor sanitization because it actively misleads the users who try to understand what they’re clicking on.

Your example of the generic confusion around host names and domains is a harder problem but people have tried to mitigate it somewhat by doing things like highlighting the domain name portion. Like most phishing techniques, passkeys will end it eventually.

Re: A clickjacking vulnerability in WhatsApp that enables phishing attacks

#18

Post by henearkr »

IshKebab wrote: post #11
Flimm wrote: post #6

It's disappointing that Meta chose not to fix this and chose not to reward this researcher with a bug bounty.

I expect they probably didn't make clear exactly what they wanted fixed (blacklisting the RTL character) and Meta thought they wanted all misleading URLs fixed which is not really possible.

How can they blacklist this character while still supporting URLs in right-to-left languages?

Re: A clickjacking vulnerability in WhatsApp that enables phishing attacks

#19

Post by Jerrrry »

IshKebab wrote: post #11
Flimm wrote: post #6

It's disappointing that Meta chose not to fix this and chose not to reward this researcher with a bug bounty.

I expect they probably didn't make clear exactly what they wanted fixed (blacklisting the RTL character) and Meta thought they wanted all misleading URLs fixed which is not really possible.

There's nothing to fix, this is intended, just often "re-discovered" behavior.
Post reply on HN