A SERIOUS flaw in WhatsApp’s design made it possible for crooks to rifle through your computer files.
WhatsApp users who own an iPhone are being urged to update their apps immediately to defend against the attack.
The bug made it possible for hackers to perform a series of clever manoeuvres to read files on your PC or Mac.
It was discovered by PerimeterX cyber-expert Gal Weizman, who revealed the attack in a blog post.
The bug affects iPhone owners who connect their handsets to a computer using WhatsApp Desktop.
This hugely popular app lets you chat with pals or colleagues on a PC or Mac linked to your phone.
Cyber-whizz Weizman found that he could use JavaScript to access your computer’s private files.
This would include sensitive documents, photos or videos.
The attack involved forge malicious links that look like genuine, safe websites inside WhatsApp.
But if you clicked one of these links, it would allow the hacker to “read” files from your computer.
Facebook, which owns WhatsApp, hails the messaging app as being very safe and secure – but this latest bug casts doubt on the claim.
In a statement, a WhatsApp spokesperson said: “We regularly work with leading security researchers to stay ahead of potential threats to our users.
“In this case, we fixed an issue that in theory could have impacted iPhone users that clicked on a malicious link while using WhatsApp on their desktop.
“The bug was promptly fixed and has been applied since mid-December.”
WhatsApp fixed the bug in December, so it’s important to update your apps to the latest version.
Update the WhatsApp app on your iPhone as well as WhatsApp Desktop on your computer.
It’s also worth being savvy about the links you click inside WhatsApp.
Researchers say there are several ways to spot if a WhatsApp message has been tampered with.
“They should look for text that might appear more like a piece of code than like legitimate text.
“The malicious message can only work if it contains the text “javascript:”, so users should be wary of this slip-up if code is visible.
“Users should exercise caution and avoid opening any links sent by unknown accounts.
“Preview banners and URLs can be misleading—even if these seem to be legitimate, users should only open them when received from a trusted source.”
WhatsApp also confirmed that it had seen no evidence of this bug being abused.
Here's what you need to know...
#
In other news, we reveal how to tell if someone has blocked you on WhatsApp.
Find out some of the best WhatsApp tricks you can try today.
WhatsApp is about to start showing you ads, and people are threatening to delete their accounts.
And we recently revealed the new WhatsApp features coming to your phone in 2020.
Do you trust Facebook and WhatsApp to protect your privacy? Let us know in the comments!
We pay for your stories! Do you have a story for The Sun Online Tech & Science team? Email us at tech@the-sun.co.uk
