Cyber criminals using email scam to spread virus via WhatsApp

MILLIONS of WhatsApp users are being warned to watch out for a fake email that will install a dangerous virus on their phones.

Clever cybercriminals have created the malware which is specifically designed to trick WhatsApp users on either iPhones or Android devices.

The virus is being circulated via email and is designed to look like it’s been sent by a legitimate source, researchers at Comodo Labs say. Fraudsters hope users will open the scam email and download the attached virus, which then infiltrates their phone.

Emails from the criminals contain sneaky subject lines including, “new voice message” or “an audio memo was missed” followed by a play button.

Others have received messages including “a brief audio recording has been delivered”, “a short vocal recording was obtained” and a fake notification about a video note.

Although none of the emails come from a WhatsApp address they are “disguised with an umbrella branding”, Comodo confirmed.

WhatsAppers should be aware that all voice memos, audio memos, recordings and notifications will be received in the app only.

Every scam email contains a compressed ZIP file which unleashes the secret malware into your phone when downloaded. The virus then duplicates in multiple system folders and adds itself into an auto-run in the computer’s registry.

“Cybercriminals are becoming more and more like marketers, trying to use creative subject lines to have unsuspecting emails be clicked and opened to spread malware,” said Fatih Orhan, a director of Comodo Antispam Labs.

“As a company, Comodo is working diligently in creating innovative technology solutions that stay a step ahead of the cybercriminals, protect and secure endpoints, and keep enterprises and IT environments safe.”

How to disable the WhatsApp blue double check on Android

Android users can now disable the blue double check in WhatsApp. The corresponding update for the app is now available from Google Play.

Do you want to know how to disable it? Follow these steps:

• From the latest version of the app, go to ‘Settings‘
• Then go to ‘Account‘
• Next ‘Privacy‘
• And finally, unselect ‘Read receipts’.

Don’t forget though, that if you disable read receipts, you won’t be able to see when your messages are read either.

What do you prefer?

Crash Your Friends' WhatsApp Remotely with Just a Message

A Vulnerability has been discovered in the wildly popular messaging app WhatsApp, which allows anyone to remotely crash WhatsApp just by sending a specially crafted message, two security researchers reported ‘The Hacker News’.

Two India based independent security researchers, Indrajeet Bhuyan and Saurav Kar, both 17-year old teenagers demonstrated the WhatsApp Message Handler vulnerability to one of our security analyst.

In a video demonstration, they showed that by sending a 2000 words (2kb in size) message in special character set can crash the receiver's app. The worried impact of the vulnerability is that the user who received the specially crafted message will have to delete his/her whole conversation and start a fresh chat, because opening the message keeps on crashing WhatsApp unless the chat is deleted completely.

"What makes it more serious is that one needs to delete entire chat with the person they are chatting to in order to get back whatsapp work in normal," Bhuyan told THN in an e-mail.

According to the duo, the reported vulnerability has been tested and successfully works on most of the versions of Android Operating system including Jellybean, Kitkat, and all the below android versions.

Similarly, Any member of your WhatsApp group could intentionally send a specially crafted message to exit people from the group and delete the group. Also, for example, if I don’t want someone to keep records of my chat with them, then I can also send the same message exploit to the person.
The vulnerability has not been tested on iOS, but it is sure that all versions of WhatsApp including 2.11.431 and 2.11.432 are affected with this bug. Also the attack does not work on Windows 8.1.

They have also provided the Proof-of-Concept (PoC) video for the attack, users can watch below.

WhatsApp, bought by Facebook for $19 billion in February this year, has 600 Million users as of October 2014, and according to the researchers, an estimated number of users affected by the vulnerability could be 500 Million.

WhatsApp was in news recently for making end-to-end encryption on all text messages as a default feature in an effort to boost the online privacy and security of its users around the world. The app maker describe this move as the "largest deployment of end-to-end encryption ever."

WhatsApp Messenger Adds End-to-End Encryption by Default

Good news for all Privacy Lovers! Finally the wildly popular messaging app WhatsApp has made end-to-end encryption a default feature, stepping a way forward for the online privacy of its users around the world.

WhatsApp, most popular messaging app with 600 Million users as of October 2014, has partnered with Open Whisper Systems to boost its privacy and security by implementing strong end-to-end encryption on all text messages.

The strong end-to-end encryption here means that even Mark Zuckerberg himself can't pry into your conversations, even if asked by law enforcement officials. The app maker describe this move as the "largest deployment of end-to-end encryption ever."

The Open Whisper System is a non-profit software organisation started by security researcher Moxie Marlinspike, who is behind the development of TextSecure app used for encryption. Over the past three years, his team has been in the process of developing a 'modern, open source, strong encryption protocol' for messaging service, which is now being incorporated into Whatsapp.

A simplified picture of how OTR protocol works, courtesy of WhisperSystems

There are some limits to WhatsApp's end-to-end encryption, as so far, it only works on Android platform (with iOS coming soon) and covers only one-to-one messages, not group messages. Also the app is now open to potential man-in-the-middle (MitM) attacks because there's no way to check or verify the identity of the person you are messaging.

WhatsApp was bought by Facebook for $19 billion in February. The popular app has been criticized over the years for a series of security and privacy issues. But after the announcement of this rollout, it has been praised over the internet by security folks.

Other encryption messaging apps do exist currently, including Cryptochat, Silent Text and Telegram, but according to the Verge, WhatsApp will be the largest to implement this type of end-to-end encryption ever.

Open Whisper Systems is a company built from open source contributors and a dedicated team to advance "state of the the art" secure communication, and is best known as the developer of the Signal, Redphone, and TextSecure apps.

WhatsApp. Beware of cyber-crooks and scams!

This week, WhatsApp has announced that it now has 600 million active users.

The news was released by Jan Koum, the CEO and co-founder of WhatsApp, through his Twitter page. Koum made it very clear that this figure refers to the number of active, not registered, users, which means that WhatsApp’s user growth may actually be larger.

The term ‘active users’ refers to the number of users who have used the app at least once in the last month.

WhatsApp security
Despite the doubts raised a few months ago when Facebook bought WhatsApp, it seems that the messaging app continues to be as popular as ever. The figure of 600 million users affirms WhatsApp as the world’s most widely used instant-messaging application, well ahead of rivals like Line or Telegram.

But this success has also placed it in the crosshairs of cyber-criminals who, over the last few months, have come up with countless ways to exploit the app as a means to attack users.

Want to know how? Discover the most dangerous WhatsApp scams and beware of malicious messages!