Privacy Concerns & Server Locations : Hike-Telegram-Whatspp

1.    I have always seen and observed discussions amongst my friends and circle about which Chat Messenger is safe and which is not in terms of safety and privacy aspects.Whether the servers are located inside the country or they are off-shores,how their data is shared and how is their privacy likely to be compromised bu third parties.....So to just do a over view check,here I present an over view of such FAQs in context of Server Locations and data sharing aspects,primarily sourced from the original websites.

Privacy Concerns & Server Locations : HIke-Telegram-Whatspp from anupam50

vCard Vulnerability : WhatsApp

1.     WhatsApp,the exceedingly renowned application that has actually swung around the way we all chat, talk, share and do so many things has so many PROs but over this small period of time since its inception it has also been the quarry of cyber criminals. With a user base as strong as 900 million active users in Apr 2015,any vulnerability in the architecture cosmos is destined to be a remunerative lure for any cyber criminal. A recent vulnerability in the form of simply sharing a vCard with other user discovered by Check Point security researcher Kasif Dekel has come to the fore. It involves simply sharing the seemingly guileless vCard with the victim and as the victim clicks the vCard, his task his over since rest will be done in the background by the malicious code terra incognita to the user. This vCard actually exists as an executable file and gets into action the moment it gets clicked by the user in the application. 

 

 

RESOLVED by update from WhatsApp 

2.   WhatsApp affirmed and recognized the security egress and have released the fix in all versions greater than 0.1.4481 and blockaded that especial lineament. 

How it Happens? 

3.   To activate the code, Kasif Dekel ascertained an attacker could just inject the command to the name attribute of the vCard file, separated by the ‘&’ character. When executed, it will attempt to run all lines in the files, including controlled injection line. Once such a contact is made, all an attacker has to do is share it via the normal WhatsApp client. 

What made the application Vulnerable? 

4.    WhatsApp Web allows users to view any type of media or attachment that can be sent or viewed by the mobile platform/application. This includes images, videos, audio files, locations and contact cards.Thus the default action runs for the vCard for running the code whilst being understood as sharing the contact details. 

 

What can it do ?

 

Once the code is activated,it is bound to take complete control over the target machine and will definitely monitor the user’s activities and use the target machine to spread malicious malwares and viruses ahead.

Timelines by CHECKPOINT on the vulnerability 

 
    August 21, 2015 – Vulnerability disclosed to the WhatsApp security team.
    August 23, 2015 – First response received.
    August 27, 2015 – WhatsApp rolls out fixed web clients (v0.1.4481)
    September 8, 2015 – Public disclosure 

Thanks CHECKPOINT

Whatsapp Chat History : How to avoid chat backing up?

1.    WhatsApp has been one of the revolutionary social networking application on the lines of various past hits like Facebook,one time orkut etc and today has a huge user base in billions exchanging all kinds of official,unofficial,personal chat kind of communications.Off course keeping a backup of all these chats is sometimes essential and in few cases for whatever reasons of the user base it is not required....the users wanna refrain from backing up anywhere any kind of history..no tell tale signs to be recovered...Although I have seen people ensuring themselves deleting the chat as it happens but that’s not a technically sound way to ensure nothing is being backed up

2.   For those who want to ensure a back up ...Daily at 0400 am the Whatsapp Auto backup is taken by the app itself so no need to worry for this and if you switch off or activate flight mode at night then one might need to take manual backup.For those who do not want any backup , a simple procedure as shown below will ensure a blank backup.

3.   Goto your Android application screen and search for MyFiles :

Choose the location where you have the default whatsapp files..in my case the default saving location is internal sd card.Click this and you look for the Whatsapp folder.

Further go inside Whatsapp folder and look for Databases....delete every thing inside this before 0400 cycle comes again.That should work....here the 0400 cycle backups the entire thing but defacto there is nothing to upload and backup.

After What's APP : Now WeChat threat!!!!

1.  Few backs earlier I wrote a post about Security Issues in Whatsapp here. Now exactly on the same lines there is a proven issue on Wechat....

2.  WeChat gained an immediate success the moment it was launched few months back in India.Every one was so happy to adopt it in their respective androids but it seems that the application is not so secure as hackers have been able to bypass the security mechanism to decrypt the messages sent using the app and China could be potentially spying on Indian citizens...
 

3.   Rest ditto from Parity news at http://www.paritynews.com/2013/08/26/2487/wechat-is-a-threat-to-national-security-claim-researchers/

According to a couple of young researchers, Jiten Jain and Abhay Agarwal, the free messaging app doesn’t employ the best of encryption and security technologies, which leaves personal information of its users vulnerable to theft. To prove their point the researchers went onto demonstrate the ease with which the messages sent using WeChat can be decrypted, indirectly indicating that foreign governments could be doing the same thing for spying and surveillance purposes.

The researchers were discussing the potential risks to privacy of users because of surveillance techniques employed by service provides across the globe at The Hackers Conference in New Delhi India on August 25. The researcher duo claimed that app from Chinese Internet Giant Tencent is threat to national security.

Jain and Agarwal claimed that not only can the Chinese government access the chat logs, but they can also access each and every detail about users stored in their smartphones – ranging from contact lists, messages, calls, geographic locations, etc.

One of other points raised at the conference was that the Indian Government is not able to successfully utilize the vast potential of security researchers in India. The Government has failed to secure its websites never mind the security of the whole nation. Researchers present at the conference stressed for the need of raising awareness about security within government establishments and masses in general.

Researches urged the government to strengthen the security of its websites as well as digital data by grooming in-house security experts as well as by availing help from industry experts present in India.

4.   In fact the duo did not hold back to say that it is a severe national threat...and I agree to their view...but who cares!!!!elections are coming...we are not even bothered about so many internal threats...external is out of purview!!!!!SAD.

"Terms & Conditions Apply" : Bon Voyage to your Privacy

1.   How many of you actually read the complete word set of "Terms and Conditions" of an application like Chrome browser ,Facebook or some thing like WhatsApp,Truecaller etc.....m sure no one hardly has time for that....ok...just for info please read the excerpt below :

Google's terms of service, for instance, clocks in at 1,711 words, according to an AFP count, not including a separate 2,382-word privacy policy that is still about 1,000 words shorter than the Google Chrome browser policy

Facebook's terms of service clocks in at 4525 words....(I did a word count with a libre office)

WhatsApp terms of service clocks in at 6549 words....(I did a word count with a libre office for this too :-)

2.    So at the above rate for a typical Internet user who installs the regular OS,Word ,PDF,VLC, it would take about 200 hours the equivalent of about one full month of work a year to fully read all the terms and conditions attached to his or her favorite websites.Will any person on earth do it?Now think over the fact that why would a company legally bind every user with thousand of words of legal agreement...what could be the motive...the motive of any company on the web is not just to save its own credibility and ass but the real motive is mining data...that's why most of it is free...why would chrome be free or for that matter why so many applications are free?...I am not trying to demean the OPENSOURCE community here who are doing a great job and I am a strict FOSS for that matter...but I would like to focus on other applications like WhatsApp,Truecaller...and so many uncountable Android,Gaba,Windows mobile applications etc....

3.   A simple click by you on Accepting the Terms and Conditions of the the application company allows your consent to online lives being archived, shared with third parties or passed on to government agencies without notice....and that's a very very serious privacy breach today when we know that in another about 4-5 years to come when our digital dependence would be like never before...this can mean havoc....for example a school student who has a home computer based on pirated or for this matter even genuine OS with loads of software's with separate set of terms and conditions.....will have his/her literally whole life profile including his FB posts,his/her preferences,his phone calls,his phone contacts,audio recordings,photographs,his/her secrets of life and anything that can be his/her privacy attribute known to the third parties with whom he has no concern...and these third parties will have their ways and means to effect his/her life in so many ways then....!!!!!

Spying your friend at WhatsApp : Cause of concern

1.   In my last post here,I discussed about the growing lure of using WhatsApp and the basic security concerns that comes with it from point of a naive user.Now will take you one step higher to the level of a script kiddie....

2.  How does WhatApp identify you in billions?The answer is the unique MAC address that each digital device on this earth holds. If any one changes his/her device,then automatically the MAC address also changes and the user is requested to re-verify their WhatsApp account. Means he/she cannot access same WhatsApp account from two devices. But is MACSPOOFING not existing ?So,if the Mac is spoofed,then who stops from seeing your friends traffic that includes his/her chats,downloads etc!!!although for a naive user this may be look of some technical nature but for the young gen which has lots of techno enthusiasts there should be no stopping....that would include rooting your phone and installing Busybox. How to get your friends MAC address,here it goes :

For Android phone users simply go to settings—> About phone—> Status—> Wi-Fi MAC address.

For iPhone users go to Settings—> General—> About—> Wi-Fi address.

For Windows Phone users go to Settings—> About—> More info—> MAC address.

and for BlackBerry users go to options—> Device—> Device and Status info—> WLAN MAC.

3.   And the best part is that your Andorid can be anyone starting from 1.6 on wards till date.

Security Issues : Whats App !!!!

1.   WhatsApp had set a new record with 27 billion messages in a day on 13th Jun 2013...now that's hell of a lot!!!!!a huge success by any means in terms of revenue generation and collection of info...as I really wonder if all these naive users most of them who are actually not aware of the kind of critical information they have allowed to be passed on...such applications are currently enjoying huge success banking on the naive users....who don't actually realize the repercussions owing to this valuable personal info loss.....just read these few eye raising conditions before any one installs this app :

- Prevent Phone from sleeping

- Change Wifi state

- write sync settings

- Modify/delete SD card contents

- read phone state

- Read contact data

- Write contact data

- Record audio

- Read my location

- Read my other accounts credentials

2.  If one goes through the deeper insights of all these aspects that the user has to invariably accept for enjoying the application thinking its free(when he has given invaluable personal info to a stranger) from point of view of security...it starts getting scary...!!!!going through the above terms it is invariably understood that all your contacts info is already gone....now how much is that info depends on how much have you stored...if you have stored the residential address,his email,his other phone numbers etc...that's all gone the moment you install!!!!..and add to this location and hardware details....from a hacker point of view the attack surface is already prepared vide one shot of installation only.....

3.  If Whatsapp says that they respect user privacy and would not submit all the info to any advertising agency or any third party...then y are they collecting all this ?Whats their security architecture?How reliable is that?Do they guarantee a NO-HACK situation?......