A Dutch researcher published a proof of concept on Tuesday that shows how a malicious application can be used to steal WhatsApp conversations on Android devices – which is particularly disconcerting considering a reported 400 million people use the cross-platform instant messaging service each month.
In this instance, the WhatsApp database being stored to the Android device's SD card can be accessed by another app, so long as the user allows it, according to a blog post by Bas Bosschert. The root of the problem lies in the Android Application Sandbox, which is meant to isolate app data and code execution.
In his proof of concept, Bosschert created an app that can access the SD card and can be used to upload the WhatsApp databases to a web server he established. The app displays a loading screen during the WhatsApp database upload, ultimately tricking users into thinking something is going on in the background.
“The WhatsApp database is a SQLite3 database which can be converted to Excel for easier access,” Bosschert wrote. “Lately WhatsApp is using encryption to encrypt the database, so it can no longer be opened by SQLite. But we can simply decrypt this database using a simple python script. This script converts the crypted database to a plain SQLite3 database (got key from Whatsapp Xtract).”
On Monday, WhatsApp – which was acquired by Facebook in February for $19 billion – launched an update for its app, but this issue still persists, according to Bosschert.
“I think this is a significant issue since it shows how poor security and programming practices can affect all of us as users, even when there is no malicious intent,” Domingo Guerra, president and founder of Appthority, said in a Wednesday email to SCMagazine.com.
Guerra said that WhatsApp should be using better encryption techniques to store chats and explained how it is not a good idea to use the SD card for storage of confidential information.
“Android has removable media, which is convenient to users and developers,” Guerra said. “However, given that it is shared storage, developers must be extra careful with what data they store on the compact flash and how they protect the data. App developers today have to operate under the assumption that folks use their phones for work and play.”
