Whitepaper: WhatsApp Security Risks - What You Need to Know

WhatsApp is a popular social messaging platform used worldwide. With such a large audience, threat actors use it to spread disinformation, distribute malware and carry out many more cyber attacks. Read our white paper to understand the threats you or your colleagues can face from using the messaging app.

Since the COVID-19 pandemic began, WhatsApp usage has nearly doubled. By all indications, the app is poised to remain the most favored messaging service for the foreseeable future.
Although WhatsApp’s parent company, Facebook, touts WhatsApp’s end-to-end encryption as evidence of the app’s strong security, there are a number of security concerns around messaging apps in general, vulnerabilities in mobile devices, and how information is stored and disseminated with third-party services impacting data transmitted over WhatsApp.

The app’s advantages, namely its simplicity and personal, closed-off nature, are also a boon for threat actors. For example, WhatsApp has been abused for disseminating disinformation and as a vector for social engineering attacks.

In March 2019, following reports of Jared Kushner’s use of WhatsApp for official White House business, GroupSense published a blog post highlighting the following five primary security concerns around using WhatsApp:

• Unencrypted WhatsApp metadata, which includes account information, messages, connections, and other information, provides insight into conversations, participants, frequency of communication, and even geolocation data.
• The WhatsApp legal agreement can mean collected metadata can be distributed as Facebook sees necessary or as compelled by law.
• Screen captures, saved media, and other files exchanged via WhatsApp are often synced with other services (e.g., iCloud, iTunes, Google), raising questions about the unintended spread of information.
• Since WhatsApp primarily functions as an app on mobile devices, any significant security vulnerabilities affecting iOS or Android can pose a security risk to WhatsApp.
• The real vulnerability is humans. WhatsApp offers a personal, closed-off service effectively leveraged by threat actors to spread disinformation and conduct social engineering attacks.

The security concerns we raised in the March 2019 blog post are even more applicable today. As the coronavirus pandemic continues, increased reliance on messaging apps to connect individuals and businesses working from home have blurred the lines between personal and work life. As the number of legitimate users on WhatsApp increases, so will the number of threat actors seeking to exploit vulnerabilities in the app itself, the host operating system, and in human nature’s susceptibility to social engineering.