WhatsApp Security Flaw Can Allow Strangers Add Themselves to Group Chats: Researchers

At the Real World Crypto security conference in Switzerland, a group of German researchers announced that they have discovered flaws in WhatsApp's end-to-end encryption.

According to a report in Wired, the researchers say that anyone who controls WhatsApp's servers can add people into private group chats, without getting the admin's permission. The new member would be able to read all messages going forward, breaking the confidentiality of the group and negating end-to-end encryption.

"The confidentiality of the group is broken as soon as the uninvited member can obtain all the new messages and read them," Wired quotes Paul Rösler, one of the Ruhr University researchers who co-authored a paper on the group messaging vulnerabilities, as saying. "If I hear there's end-to-end encryption for both groups and two-party communications, that means adding of new members should be protected against. And if not, the value of encryption is very little."

Although this is a serious concern, the requirement that this method has of controlling WhatsApp servers would appear to limit the risk factors a little. Extremely sophisticated hackers, WhatsApp's own staff, and state actors are the different kinds of people who would be able to exploit this. And even then, all messages previous to the insertion of a new member would remain private.

Facebook’s Chief Security Officer Alex Stamos, responding to the report on Twitter, said, “Read the Wired article today about WhatsApp – scary headline! But there is no [sic] a secret way into WhatsApp groups chats.”

Stamos further pointed out in his tweets that everyone in the group would see a message that a new member has joined, so this wouldn't be a stealthy strategy for government spying.

"On WhatsApp, existing members of a group are notified when new people are added," he tweeted. "WhatsApp is built so group messages cannot be send [sic] to hidden users and provides multiple ways for users to confirm who receives a message prior to it being sent."

He added that the report has been looked at carefully, and while there may be a way to add more protections, it's not clear cut. "In sum, the clear notifications and multiple ways of checking who is in your group prevent silent eavesdropping," he wrote. "The content of messages sent in WhatsApp groups remain protected by end-to-end encryption."