Pwning WhatsApp The Dark Side Of Web based Messaging Apps
summary
Demonstrates concrete, working flaws: reply-text fabrication lets a sender craft a fake quoted message; rich-preview URL tampering creates an open redirect that looks like facebook.com but points elsewhere; embedding a javascript URL yields a client-stored XSS that executes when clicked (works on Safari and old Edge); CSP is bypassed by abusing a missing object-src directive and using an object + postMessage to load changing payloads; WhatsApp Desktop ships Electron with Chromium 69 enabling local file reads and theoretical RCE. Tools include bitly redirects, CSP Evaluator and crafted object elements; all attacks are demonstrated end-to-end.
AI-written summary · about
chapters (14)
- 0:00Start
- 0:46About Me
- 3:29How It All Started
- 6:40Rich Preview Banners Are Generated On The Sender Side
- 7:38DEMO
- 8:09As Phishy As It Gets - Weaponize The Exploit
- 8:59Escalation To XSS
- 12:33How Does One Bypass CSP?
- 13:02Using object-src Directive To Bypass CSP
- 15:42WhatsApp Desktop - A Song of Web And Native?
- 18:01Ability To Read From The Local File System
- 20:06Why Am I Telling You All This?
- 21:23Technical Conclusions (most important sidel)
- 26:34Sum Up
related talks
58mExploiting web messaging implementations
23mReverse Engineering WhatsApp Encryption for Chat Manipulation and More
50mModern WebApp Vulnerabilities
39mUsing WhatsApp as a Command Line ( Breaking out of the walled Garden)
43mAttacking Modern Web Technologies
34m"The magic of XSS - not only in web applications"
38mCaught My WebApp Cheating on Me!
32m(In)Secure Messaging Apps: A Lateral Movement Into Your Privacy