It's disappointing that Meta chose not to fix this and chose not to reward this researcher with a bug bounty.
They're to busy sending legal threats to OSS projects
A clickjacking vulnerability in WhatsApp that enables phishing attacks
21–30 of 84 posts
Re: A clickjacking vulnerability in WhatsApp that enables phishing attacks
#22It's disappointing that Meta chose not to fix this and chose not to reward this researcher with a bug bounty.
I reported a similar issue to Google early this year and they declined the submission because it "can only result from social engineering" and "we think that addressing it would not make our users significantly less vulnerable".
I won't mention the details here but Google Search sometimes rewrite URLs in such way that an attacker can spoof the actual URL.
My advice is to never trust URLs displayed by websites and apps.
Re: A clickjacking vulnerability in WhatsApp that enables phishing attacks
#23Earlier quoted context omitted.
I expect they probably didn't make clear exactly what they wanted fixed (blacklisting the RTL character) and Meta thought they wanted all misleading URLs fixed which is not really possible.
How can they blacklist this character while still supporting URLs in right-to-left languages?
The client should probably be aware of whether the user might be expecting RTL text and maybe display a warning if not? Arabic users receiving a URL containing the character shouldn't raise any eyebrows, but if a random Anglo user clicks on one it might be worth displaying a warning that it's backwards text? At least the first time.
Re: A clickjacking vulnerability in WhatsApp that enables phishing attacks
#24What’s happening with the Whatsapp osx app. It’s so bad to use nowadays, slow, buggy.
Re: A clickjacking vulnerability in WhatsApp that enables phishing attacks
#25Earlier quoted context omitted.
I expect they probably didn't make clear exactly what they wanted fixed (blacklisting the RTL character) and Meta thought they wanted all misleading URLs fixed which is not really possible.
There's nothing to fix, this is intended, just often "re-discovered" behavior.
TFA mentions that Twitter, TikTok, and Pinterest all sanitize U+202E. Sanitizing it in WhatsApp would be a nice fix.
Re: A clickjacking vulnerability in WhatsApp that enables phishing attacks
#26Earlier quoted context omitted.
How can they blacklist this character while still supporting URLs in right-to-left languages?
The client should probably be aware of whether the user might be expecting RTL text and maybe display a warning if not? Arabic users receiving a URL containing the character shouldn't raise any eyebrows, but if a random Anglo user clicks on one it might be worth displaying a warning that it's backwards text? At least the first time.
It wouldn't really solve the problem, sadly. The percentage of people who'd bother to read that warning is likely quite low.
Re: A clickjacking vulnerability in WhatsApp that enables phishing attacks
#27Very cool attack, and easy to read write up. I have one basic question: It was mentioned that attacking the encryption was skipped in favor of using a debugger. Was this debugger applied to the WhatsApp Web app? Or was the debugger deployed on the phone? Was it an emulator? For some reason I didn't think WhatsApp had a web app (I don't use it).
The article says "I decided to intercept a message via WA web".
That was the initial idea, but it failed because Whatsapp traffic is end to end encrytped. The second idea, which actually worked, was to put a breakpoint in Whatsapp while running in an emulator.
Re: A clickjacking vulnerability in WhatsApp that enables phishing attacks
#28Earlier quoted context omitted.
I expect they probably didn't make clear exactly what they wanted fixed (blacklisting the RTL character) and Meta thought they wanted all misleading URLs fixed which is not really possible.
How can they blacklist this character while still supporting URLs in right-to-left languages?
You can only apply the fix to the URL field in the payload described, not to normal message text.
Re: A clickjacking vulnerability in WhatsApp that enables phishing attacks
#29I remember this already existed on Windows Explorer 2 decades ago, it's funny to see it "rediscovered".
The attack still works and it is less obvious than you might expect. For context, an SCR file is a regular executable, treated the same as a .EXE or .COM. From https://attack.mitre.org/techniques/T1036/002/ : > RTLO is a non-printing Unicode character that causes the text that follows it to be displayed in reverse. For example, a Windows screensaver executable named `March 25 \u202Excod.scr` will display as `March 25…
Unicode is hell really.
Re: A clickjacking vulnerability in WhatsApp that enables phishing attacks
#30Earlier quoted context omitted.
The client should probably be aware of whether the user might be expecting RTL text and maybe display a warning if not? Arabic users receiving a URL containing the character shouldn't raise any eyebrows, but if a random Anglo user clicks on one it might be worth displaying a warning that it's backwards text? At least the first time.
It wouldn't really solve the problem, sadly. The percentage of people who'd bother to read that warning is likely quite low.
I don't think that's a good reason for not including such a warning.
"quite low" for a service with billions of users, can still allow for million of users who would benefit from seeing the warning.