ShmooCon 2014: Malicious Threats, Vulnerabilities in Mobile Instant Messaging Platforms
Channel: Christiaan008
Date: 2014-04-24

For more information visit: http://bit.ly/shmooc14
To download the video visit: http://bit.ly/shmooc14_down
Playlist Shmoocon 2014: http://bit.ly/shmooc14_pl

Speakers: Jaime Sanchez | Pablo San Emeterio

Global surveillance emerged as a phenomenon since the late 1940s and Internet and mobile technology are being developed with such pace that it is impossible to guarantee electronic privacy and nobody should expect it. How strong are the actual Instant Messaging Platforms? Do they take care of our security and privacy? We'll look inside the security of several clients (like BBM, Snapchat, and Line) and will put our focus on WhatsApp.

WhatsApp might not be as widely known as Twitter, but the company announced that it has passed 350 million active monthly users. WhatsApp has been plagued by several security issues in the past, so we decided to start the research. We've discovered several vulnerabilities more that we'll disclosure (with proof of concept code), including encryption flaws, remote DOS (making the client crash by sending a custom message), or how to spoof messages manipulating sender address information.

We'll also release a new version of our tool with different protection layers: encryption, anonymity, and using a custom XMPP server. It's necessary to implement additional measures until WhatsApp decides to take security seriously.