WhatsApp security loophole can add uninvited members to your groups

WhatsApp is adding numerous features to its platform to enhance the user experience. In the meantime, a team of cryptographers from Germany claims to have uncovered flaws in the security of WhatsApp. It is said that this flaw can comprise of the end-to-end encryption of the messaging platform.

The newly published paper claims that anyone who has control of the WhatsApp services including the employees of the company can covertly add the members to any WhatsApp group. Usually, only admins can add the new members to private groups. But the researchers have found that anyone having control of the server can break the authentication process that grants them the privilege that is needed to add new members to the private groups.

Once a new member who is uninvited has been added to the group, the confidentiality of the group will be broken as the member can access all the new messages and read them, claims one of the researchers.

WhatsApp live location sharing feature to Android and iOS

According to the researchers, the breach can manipulate the messages from the admin that would alert the members of the group that someone new has been added. A report by Wired has confirmed these findings with a WhatsApp spokesperson. WhatsApp has also acknowledged this server security issue but the spokesperson has pushed the idea that the attackers can cache, block or prevent the alert stating new members have been added.

It is common for existing members to be alerted when new members are added to the WhatsApp group. The application has been designed in such a way that the group messages cannot be sent to any hidden user. Given that the security and privacy of the users is a priority for WhatsApp, they collect very little information and all the messages are end-to-end encrypted.

Even the researchers who have come up with this security loophole agree to the fact that the level of sophistication needed to compromise the servers of WhatsApp makes such attacks on WhatsApp groups unlikely. However, this is a security hole that cannot be excused, claims the report. End-to-end encryption offered by WhatsApp should be applicable on the server level to prevent such issues.