Hijacking Whatsapp and how to prevent it

[Sinbad]

Well tested it now. Sent myself an sms. The phone went ping and the notification light flashed. Screen didn't even turn on.
Turned on screen, notification icon present in the bar but no text.

 

[JerryMungo]

Well tested it now. Sent myself an sms. The phone went ping and the notification light flashed. Screen didn't even turn on.
Turned on screen, notification icon present in the bar but no text.

And that should be the default. I wouldn't be surprised if we see more of this going forward. I wonder if that's an Android evolution or Huawei. I'm guessing Huawei - check the links I posted above... default android settings overridden by the manufacturer's themes.

 

[Sinbad]

And that should be the default. I wouldn't be surprised if we see more of this going forward. I wonder if that's an Android evolution or Huawei. I'm guessing Huawei - check the links I posted above.

I suspect it's an android 8 thing...?
Searching in settings I seriously cannot find anything about lock screen notifications.

 

[JerryMungo]

Well tested it now. Sent myself an sms. The phone went ping and the notification light flashed. Screen didn't even turn on.
Turned on screen, notification icon present in the bar but no text.

Not sure if related - I don't have the phone to test right now...

 

[RedViking]

So this might be common knowledge to most, but I thought i'd just post my quick experience of how easy it is to hijack a Whatsapp profile with limited access to the person's phone.

1) Install or reinstall Whatsapp on your device (or Android emulator) - the device needn't have a SIM, only internet connectivity.
2) When you start Whatsapp, it asks for your cell number to verify it - enter the number of the target phone to hijack
3) It takes a minute to verify the phone then it sends an SMS to the target phone
4) Glance at the target phone screen and get the 6 digit code that was SMS'd (even if it's locked, it could show up on the lock screen)
5) Enter it into your phone into Whatsapp
DONE

You now have full access to the victim's whatsapp to send / receive messages (and possibly bank with Absa if they have set it up on Whatsapp?)

Steps to prevent being hijacked this way:
1) Disable sensitive notifications on your lock screen (both Android and iOS can do this - under settings) - obviously have a secure pin / lock screen
2) Enable Whatsapp 2FA - when the attacker tries to set up Whatsapp on the new device, it requests your 2FA pin.

[MENTION=106091]sajunky[/MENTION] check this out

 

[Sinbad]

Ah I see it. It's set at app level.

 

[JerryMungo]

[MENTION=106091]sajunky[/MENTION] check this out

Oh please no! :crylaugh:

 

[Polymathic]

Who the **** allows full notification display on lock screen?

My current phone does this by default and haven't bothered to change it

 

[RedViking]

Oh please no! :crylaugh:

 

[isie]

No, you don't seem to understand. Look at the opening post. The PHONE IS LOCKED. Do you need a video?

You do realise that not EVERYONE knows about the setting to turn off lock screen sensitive notifications? If you do, then why are you arguing the point of how easy it is to hijack Whatsapp when instructions for setting your phone up properly is already in the opening post?

Again, locking your phone does SQUAT to prevent Whatsapp hijacking. How many times must it be said?

Then Change your Title this isn't a whatsapp issue its a a phone setting issue. It not only affects whatsapp is what i'm saying!

You still haven't pointed out how this is whatsappc specific issue compared to every other thing i mentioned?
If you hijack my whatsapp and i still have my phone i can stop it - if you stole my phone and its open thats my stupidity - again not whatsapp.

Comprende

 

[isie]

[MENTION=106091]sajunky[/MENTION] check this out

View attachment 536397

 

[JerryMungo]

Then Change your Title this isn't a whatsapp issue its a a phone setting issue. It not only affects whatsapp is what i'm saying!

You still haven't pointed out how this is whatsappc specific issue compared to every other thing i mentioned?
If you hijack my whatsapp and i still have my phone i can stop it - if you stole my phone and its open thats my stupidity - again not whatsapp.

Comprende

No. You just need to apply your mind. The title isn't about any issue to start with, so why should it be a whatsapp specific issue? It's an informational post.

 

[isie]

No. You just need to apply your mind. The title isn't about any issue to start with, so why should it be a whatsapp specific issue? It's an informational post.

You changed your original post to include theft - but like i said all this relies on user stupidity again not whatsapp fault.

 

[JerryMungo]

You changed your original post to include theft - but like i said all this relies on user stupidity again not whatsapp fault.

This is an informational post, stop trolling. User stupidity has nothing to do with it, neither did anyone point out that this a fault of whatsapp.
If you like the sound of your own voice, start a thread.

 

[isie]

This is an informational post, stop trolling. User stupidity has nothing to do with it.

Who is trolling just pointing out the fact that as soon as whatsapp using the same number is set up in another phone the first phone is notified that it needs to verify, and you can reclaim it. You did not mentioned theft in your original post - and like i said if they stole your phone and have access to it whatsapp is the least of your worries.

 

[JerryMungo]

Who is trolling just pointing out the fact that as soon as whatsapp using the same number is set up in another phone the first phone is notified that it needs to verify, and you can reclaim it.

Except you're not, are you? If you can find fault with the facts of the OP, point them out. Your added 5c does not change the facts as stated in the OP.

You did not mentioned theft in your original post

Why do I have to mention it? There are a ton of use cases for this kind of exploit, use your imagination.

and like i said if they stole your phone and have access to it whatsapp is the least of your worries.

That's relative to the information it contains or what it's used for - like banking.

Let's make it simple: question for you - if you can do something about securing Whatsapp, would you?

 

[isie]

Except you're not, are you? If you can find fault with the facts of the OP, point them out. Your added 5c does not change the facts as stated in the OP.

If i can stop it by simply verifying my phone number you 'hack' does not work Fact is thats the first thing to stop this plus you are actually notified of this immediately - like i said if not stolen how else they can access your phone with out yo unot knowing.
. how else's will an unscrupulous person get hold of your phone - unless you hang out with untrustworthy people

Why do I have to mention it? There are a ton of use cases for this kind of exploit, use your imagination.

If there are ton mentione it - I have a vivid imagination that doesnt mean its possible.

That's relative to the information it contains or what it's used for - like banking.

Let's make it simple: question for you - if you can do something about securing Whatsapp, would you?

What part of where I said numerous times if you not securing your phone whatsapp is the least of your worries?

 

[JerryMungo]

If i can stop it by simply verifying my phone number you 'hack' does not work Fact is thats the first thing to stop this plus you are actually notified of this immediately - like i said if not stolen how else they can access your phone with out yo unot knowing.
. how else's will an unscrupulous person get hold of your phone - unless you hang out with untrustworthy people

What does anything you've just said have to do with the facts? You can only "STOP" it if you notice it, or you have the phone. Why do we have to spell these things out for you? Try to picture this. You have a new job, new colleages - one if a shyster. You go to the bathroom or you go to someone else's office and leave your phone on charge on your desk. This dodgy new colleague decides they want to have a bit of fun... Now you only notice it when you open whatsapp. Of course that could be minutes or hours, depending on how much time you go without staring at whatsapp. Sure that could be 5 minutes in your case, but could also be hours in other people's case. Not that hard to imagine. What if the shyster sticks your phone in a filing cabinet while he has "fun" with your account... now it may be harmless fun, it may not be, it's just a scenario. And don't come with the 'unless you hang out with untrustworthy people' bull. I'm sure you hang with friends and family 24x7 but you're unique in that way. Remember, stuff that gets posted in here could apply to anyone including scholars and Uni students, those who work in dodgy countries, etc. etc.

If there are ton mentione it - I have a vivid imagination that doesnt mean its possible.

I've mentioned enough to get any normal person's brain filling in the blanks.

What part of where I said numerous times if you not securing your phone whatsapp is the least of your worries?

What part of your worries and the guy's next to you are not the same do you not understand? This is not myisie.co.za.

Here's a gem for you. Use it / don't use it.

 

[isie]

What does anything you've just said have to do with the facts? You can only "STOP" it if you notice it, or you have the phone.

It pops up on your phone as soon as another account is active - you OP doesn't mentioned that the phone is stolen.

Why do we have to spell these things out for you?

Not to me but if you are idiotic enough to leave you phone out unsecured this guide is for those idiots so you need to spell things out

Try to picture this. You have a new job, new colleages - one if a shyster. You go to the bathroom or you go to someone else's office and leave your phone on charge on your desk. This dodgy new colleague decides they want to have a bit of fun... Now you only notice it when you open whatsapp. Of course that could be minutes or hours, depending on how much time you go without staring at whatsapp. Sure that could be 5 minutes in your case, but could also be hours in other people's case. Not that hard to imagine. What if the shyster sticks your phone in a filing cabinet while he has "fun" with your account... now it may be harmless fun, it may not be, it's just a scenario. And don't come with the 'unless you hang out with untrustworthy people' bull. I'm sure you hang with friends and family 24x7 but you're unique in that way. Remember, stuff that gets posted in here could apply to anyone including scholars and Uni students, those who work in dodgy countries, etc. etc.

won't affect me but as you said it you have a crowd of different people so why leave out a fact that they can stop it as well - so why leave out that fact - you catering for idiots so make sure to include everything

Use it / don't use it.[/U]

Again an intelligent person doesn't leave his phone out unsecured so your guide is not for a person who does this.
I have no issue with your 'tips' they good- WHat i'm saying and you don't seem to understand -if you leave your phone unlocked and notification (open if locked) WHatsapp is the least of your concerns you have are leaving yourself open to so much more.

 

[SauRoNZA]

My phone has a thing in the notification bar when WhatsApp Web is active. Surely it's impossible for someone to stealthily use your WhatsApp?

And these days everyone has biometric security. Just don't leave your phone unguarded.

This has nothing to do with Whatsapp Web.

In fact it doesn't have anything to do with Whatsapp and everything to do with a failure of lock screen security on the "victim's" part.

The same trick can be applied for a great many other things if you leave your phone unattended like this.