End-to-end encryption of messages in transit on apps like WhatsApp and Telegram may not always be able to keep files safe after they’re on your phone. According to a report on messaging by researchers from Symantec it was discovered how hackers could use a malicious app to change media files sent through the services. Users generally trust encrypted apps to protect the integrity of both the identity of the sender and the message content itself.
The Android Operating system allows apps to choose where to save media, like images and audio files. This can be done through either internal storage that’s only accessible through the app, or external storage which is more widely available to other apps. Popular messaging apps like WhatsApp, by default, stores media through external storage, and Telegram does so when the app’s “Save to Gallery” feature is enabled.
According to the researchers, the design means malware with external storage access could be used to access WhatsApp and Telegram media files, maybe even before the user sees them. If a user downloads a malicious app, for example, and then receives a photo on WhatsApp, a hacker could manipulate the image without the receiver ever noticing. A hacker could theoretically alter an outgoing multimedia message as well.
“Media File Jacking” is the term the researchers are using. In many ways, it’s a known issue, and a trade-off between privacy and accessibility for messaging apps on Android. By using the external storage setting, which is widely used, apps are more compatible with others, allowing pictures and other data to move more freely. But that comes with a cost: last year, researchers pointed out similar issues.
A WhatsApp spokesperson said changing its storage system would limit the service’s ability to share media files, and even introduce new privacy issues. “WhatsApp has looked closely at this issue and it’s similar to previous questions about mobile device storage impacting the app ecosystem,” the spokesperson said in a statement. “WhatsApp follows current best practices provided by operating systems for media storage and looks forward to providing updates in line with Android’s ongoing development.”
“However,” the researchers write, “as we’ve mentioned in the past, no code is immune to security vulnerabilities.”
