By now, we should all know that email attachments can be a real danger to our computers and mobile devices. Now the danger also moves to instant messaging applications, such as WhatsApp Web and Telegram Web. With today's news, you will think twice before opening every single file sent to you.
We all have that typical group or channel where images and videos of all kinds are shared with us, from jokes to hidden cameras, pasando, of course, because of the spiciness that is usually on the Internet.
Following the popular request of internet users to WhatsApp and Telegram, the two giants of instant messaging, to transfer applications born on mobile devices to desktop computers, both for the convenience of typing with a physical keyboard, and for not having to constantly look at the phone, they made the jump to computers through their web versions. This created vulnerabilities that did not exist in the “traditional versions”, but that seriously compromise the security of your account.
Both Telegram and WhatsApp use encryption in message exchange so that only the sender and receiver of the communication can read them and so that no outsiders can read possible messages intercepted in the communication. El peligro residía en que tanto WhatsApp como Telegram no miraban qué había en el interior, debido a este cifrado, con lo que se podía ocultar código malicioso o malwaredentro de las imágenes o vídeos compartidos en el chat.
Este fallo de seguridad, permitía a una persona con malas intenciones tomar el total control de las cuentas afectadas.
Se ha creado una demostración en vídeo para que veáis lo sencillo que es y cómo la víctima no se percata de absolutamente nada:
Pero tranquilidad, que no panda el cúnico, la vulnerabilidad sólo afectaba a las versiones Web de las aplicaciones y ya ha sido convenientemente parcheada. Lo único que tendrás que hacer es reiniciar el navegador si eres de los que deja la sesión de WhatsApp o Telegram iniciada durante semanas.