Researchers say the flaw could be used to spread fake news across the platform.
Researchers have uncovered a vulnerability in WhatsApp's encryption method that can allow malicious actors to manipulate messages and user identities in group chats, with the fear that this could be used to spread fake messages and news.
All messages sent through the service are secured via end-to-end encryption – meaning not even WhatsApp is able to see them. But a team from Check Point Research discovered three methods of attack that can be derived from reversing this encryption process, and then accessing the decrypted communications data.
Using the 'quote' feature in a group chat, hackers can change the identity of a sender, alter the text of a previously sent message, and send a private message to a group member disguised as a public message – meaning their response (to what they believe is a private message) will be made public.
"WhatsApp, has over 1.5 billion users with over one billion groups and 65 billion messages sent every day. With so much chatter, the potential for online scams, rumours and fake news is huge," Check Point Research's Dikla Barda, Roman Zaikin and Oded Vananu wrote in a blog post.
"It doesn't help then, if threat actors have an additional weapon in their arsenal to leverage the platform for their malicious intentions."
"Following the process of Responsible Disclosure, Check Point Research informed WhatsApp of their findings. From Check Point Research's view, we believe these vulnerabilities to be of the utmost importance and require attention."
After decrypting WhatsApp messages and accessing them via the web, the researchers were able not only to see the individual parameters that make up the messages – i.e. the sender name, message content, recipient name, etc – but manipulate these fields.
In one example, researchers were able to change a message posted in a group chat from a link to an article recommending "great health tips", to a message that read "guys I just heard product X can cause illness in children. I will not be buying it anymore!!" using the quote feature.
The researchers also developed a version of the tool they used to demonstrate the exploits that users can download for free via Github.
IT Pro has contacted WhatsApp for comment.