WhatsApp now accessible on browser

In the latest update for the most popular messaging application WhatsApp , company has introduced the cool feature for accessing your whatapp chats and messages on your browser.This particular blog details about how to enable access to your whatsapp account on desktop browser and extra things which you need to take care of while using this feature in order to prevent yourself from Hacked.  With cool new features and usability there always comes a security risk , therefore one must always be aware and careful about the security aspects as detailed below.

Enabling access to Whatsapp web

1. Update your whatsapp application to latest build.
2. Open google chrome browser and goto following URL: https://web.whatsapp.com/
3. Open your whatsapp on mobile device.
4. Tap on three dots (options feature)
5. Once using latest version of whatsapp , you can see WhatsApp Web option
6. Tap on it , you will be asked to scan a QR code.
7. Goto to chrome browser tab just opened , scan the QR code from your device.
8 . you are all set to GO and USE the cool new feature for WhatsApp now on your browser.

Now you can use fully functional whatsapp app on your browser just like you use it on your device.

Important Things to remember:

 1. You must have internet connectivity on your phone to access and use this feature even when you are logged into your browser whatsapp.

2. Since this entire process requires just scanning the QR code from user's device, this increases the risk of your account been enabled by someone else on his browser with a simple borrowing your phone for  less than 1 minute.  Therefore its more important to place a security lock on your application., so that it cannot be accessed by anyone whom you lend your device even for a minute.

3. In case someone has successfully tried to access your account on his browser, or you sense some malicious activity being performed from your device  no need to worry whatsapp has provided an option to logout from any of the computers.

So Goto to same option Whatsapp Web int the device and tap on it. you can see mobile browser from which your account is logged in and time. You have the option to  there to logout from all the browsers.

So Happy whatsapping...!!!!!!

Hack any wechat account by exploiting weak authentication system.

Wechat account is vulnerable to weak authentication mechanism. During my security research I found this flaw and it can very easily be exploited using simple social engg technique. The Wechat generates a simple Authentication token or OTP  and send it to user mobile phone. If anyhow using social engg this auth token is obtained then any user can log into or delete victim's account without using any user-id and password of victim. Attacker can also reset the password of victim using same technique. Flaw exist in weak single layer authentication. Even banks implement this authentication token mechanism but they do have multiple layer of security. It is better to reset user password by sending mail to user's primary email or secondary email address which is often secure as compared to using a single token on mobile phone.

All Android apps developers and security researchers should mark this as a issue and try to implement more stronger authentication mechainsm.

I tried to contact with  Wechat team but didn't got any response from there.

Complete report with PoC is as follows.

Step1:  Attacker is on his phone ie; android and clicks on “Can’t access your account”  option

     Step2: Attacker is presented with several option to gain his account back via Email or sms

   

                                                        

                                                         

 

Step3: Attacker selects the option Log in via SMS and is presented with option to enter phone number

Step4: Attacker enters the phone number of his friend or victim and click Next

 

                                                      

                                                                      

    

                                  

Now an attacker  having access to victim's phone can easily access that verification code. Access to victim's phone can also be obtained very easilyby just asking the victim who might be a friend to attacker to make a call and thereby gaining access to only verificaton code send by wechat server OR attacker can use any othr social engg technique to trick the victim and obtain the code.

Step5: victim is already logged into his windows phone in his wechat  account and still gets the verification code on his mobile.

 

Step6: Attacker enters that authentication code into his android phone 

Step7: After entering auth code attacker is directly logged into the victim's account without any user id and password

Step8: After gaining access to victim's account attacker can change the password of victim's account. when selecting Logout option attacker is presented with window to reset the password.

      

                                                      Account HACKED !!!!!!!!!!!!

Victim is automatically logged out of his account and presented with invalid account error message when tries to login with his userid-password combination 

 

Using the same verification code it is possible to delete any existing user's account by just entering his phone number.

This is how a wechat account of any user can be compromised , Social engg technique do work as i have tried this on some of people know to me and it works perfectly.

 Thanks