{"id":278491,"date":"2018-10-04T20:07:09","date_gmt":"2018-10-04T18:07:09","guid":{"rendered":"https:\/\/mybroadband.co.za\/news\/?p=278491"},"modified":"2018-10-04T21:05:13","modified_gmt":"2018-10-04T19:05:13","slug":"whatsapp-account-hijacking-warning","status":"publish","type":"post","link":"https:\/\/mybroadband.co.za\/news\/security\/278491-whatsapp-account-hijacking-warning.html","title":{"rendered":"WhatsApp account hijacking warning"},"content":{"rendered":"<p>The Israel National Cyber Security Authority has sent out a nationwide security alert, warning users about a new method of hijacking WhatsApp accounts.<\/p>\n<p>The Israeli Prime Minister&#8217;s Office <a href=\"https:\/\/www.israelnationalnews.com\/News\/News.aspx\/252682\" target=\"_blank\" rel=\"noopener\"><strong>said in a statement<\/strong><\/a> that they have received several reports of private WhatsApp accounts being hacked.<\/p>\n<p>The method, which has been used to hijack many WhatsApp accounts already, uses the mobile providers\u2019 voicemail systems.<\/p>\n<p><a href=\"https:\/\/www.zdnet.com\/article\/recent-wave-of-hijacked-whatsapp-accounts-traced-back-to-voicemail-hacking\/\" target=\"_blank\" rel=\"noopener\"><strong>ZDNet reported<\/strong><\/a> that users who have voicemail accounts with default passwords \u2013 typically 0000 or 1234 \u2013 are at risk.<\/p>\n<p>The WhatsApp account takeover attack happens as follows:<\/p>\n<ul>\n<li>The attacker tries to add a legitimate user\u2019s phone number to a new WhatsApp installation on his own phone.<\/li>\n<li>WhatsApp\u2019s security procedure will send a one-time code via SMS to the victim\u2019s phone. This will alert the legitimate user of the attack, but if it happens when they are asleep, they will not know.<\/li>\n<li>Several failed SMS validation attempts result in WhatsApp prompting the user to do a \u201cvoice verification\u201d. WhatsApp will call the victim\u2019s phone and speak the one-time verification code.<\/li>\n<li>This code, which was phoned through by WhatsApp to the victim\u2019s phone, will land up in voicemail if the victim does not answer.<\/li>\n<li>The attacker can now access the victim\u2019s voicemail account, and get access to the one-time code to hijack the victim\u2019s WhatsApp account.<\/li>\n<\/ul>\n<p>\u201cOnce the hacker has gained access to the WhatsApp account, he can enable two-step verification, which would prevent the legitimate owner from re-taking control over his WhatsApp account without a six-digit number only the attacker knows,\u201d ZDNet explained.<\/p>\n<p>To prevent falling victim to this WhatsApp account hacking method, users are encouraged to change their voicemail passwords and enable WhatsApp&#8217;s two-step verification.<\/p>\n<h3 class=\"my-4\">WhatsApp account hijacking demo<\/h3>\n<p>Security researcher Martin Vigo <a href=\"https:\/\/www.kaspersky.co.za\/blog\/hacking-online-accounts-via-voice-mail\/20815\/\" target=\"_blank\" rel=\"noopener\"><strong>demonstrated<\/strong><\/a> how a WhatsApp account can be hijacked via voicemail at DEF CON 26.<\/p>\n<p><iframe loading=\"lazy\" src=\"https:\/\/www.youtube.com\/embed\/-n2NCc5TnCE\" width=\"640\" height=\"360\" frameborder=\"0\" allowfullscreen=\"allowfullscreen\"><\/iframe><\/p>\n<h3 class=\"my-4\">Now read:\u00a0<a href=\"https:\/\/mybroadband.co.za\/news\/cellular\/278399-mtn-launches-new-contract-bundles-with-free-whatsapp-and-facebook.html\">MTN launches new contract bundles with free WhatsApp and Facebook<\/a><\/h3>\n","protected":false},"excerpt":{"rendered":"<p>A new hacking method allows attackers to hijack your WhatsApp account.<\/p>\n","protected":false},"author":23,"featured_media":168223,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_sma_x_autopost_status":"idle","_sma_x_autopost_error":"","_sma_x_post_id":"","_sma_facebook_post_id":"","_sma_instagram_post_id":"","_sma_threads_post_id":"","_sma_x_attempts":0,"footnotes":""},"categories":[27],"tags":[35,2594,54323],"class_list":["post-278491","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","tag-headline","tag-whatsapp","tag-whatsapp-hijacking"],"_links":{"self":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/278491"}],"collection":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/users\/23"}],"replies":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/comments?post=278491"}],"version-history":[{"count":1,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/278491\/revisions"}],"predecessor-version":[{"id":278493,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/278491\/revisions\/278493"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media\/168223"}],"wp:attachment":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media?parent=278491"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/categories?post=278491"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/tags?post=278491"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}