By Neelabh Srivastava
New Delhi ~ Indian cyber security agency CERT-In has flagged a vulnerability in the WhatsApp “device-linking” feature that enables attackers to take “complete” control of an account, including access to real-time messages, photos, and videos on the web version.
The agency named the issue “GhostPairing” on Friday in an advisory that has been accessed by PTI.
“It has been reported that malicious actors are exploiting WhatsApp’s device-linking feature to hijack accounts using pairing codes without authentication requirements.
“This newly identified cyber campaign called GhostPairing enables cybercriminals to take complete control of WhatsApp accounts without needing passwords or SIM swaps,” the advisory said.
A response from WhatsApp to the revelation is awaited.
The Indian Computer Emergency Response Team (CERT-In) is the national technology arm to combat cyber attacks and guard the Indian Internet space.
The advisory said that the “high” severity attack campaign usually begins with the victim receiving a message like “Hi, check this photo” from a “trusted” contact.
The message contains a link with a Facebook-style preview. The link leads to a “fake” Facebook viewer that prompts users to “verify” to see the content. Here, the attackers exploit WhatsApp’s “link device via phone number” feature by tricking unsuspecting users into entering their phone numbers, the advisory said.
This way, the victims “unknowingly” grant the attackers full access to their WhatsApp accounts.
The ‘GhostPairing’ attack tricks users into granting an attacker’s browser access as an additional trusted and hidden device by using a pairing code that looks authentic.
The advisory said that once the attacker links their device, they get almost the same access as the victim would get on WhatsApp Web.
They can read messages that sync to their device, receive new messages in real time, and view photos, videos and voice notes, and they can send messages to the victim’s contacts and group chats, the advisory said.
The agency suggested such countermeasures as not clicking suspicious links even if they come from known contacts and not entering one’s phone number on external sites claiming to be WhatsApp or Facebook.
