Whatsapp security hole allows changing status message of other users (opens in new tab)

As a frequent WhatsApp user I don't find this amusing at all. If this is how the engineers handle security issues, it might be time to convince my friends to switch to another messenger. It's not like there was no competition in that field.

The initial design of WhatsApp was as an app to share your status. Only later did they add messaging. Which is the functionality that actually made them take off. But they've never removed the statua part, even though nobody uses it.

Of course, these security holes are not so hilarious to WhatsApp users who think their chats are encrypted on route to WhatsApp's servers :)

Umm, I think a malicious user could write things in your status that could have negative consequences for you.

Ain't working for me either, but I've read report of people who were able to to that.

Too bad :)

Mikko Hypponen reblogged a tweet mentioning it, so it has to be legit. :)

Wow it seems there is no security at all:

> By providing any WhatsApp registered telephone number and the text for the status update, it is possible to change a user's status. This action does not require any prior authentication or authorization

> (on registration) The vendor has implemented bruteforce protection by locking a number after 10 tries. This step makes a successful attack on a specific number unlikely but an attacker bruteforcing X00 numbers can still guess X number(s) on average.

> As published in the past several times already the XMPP traffic from WhatsApp is not encrypted.

And they are planning to charge money for it?

edit: perhaps even worse is their response to the security vulnerability seen in the timeline - they knew about the bug since 09-14