New WhatsApp bug via MP4 file triggers snooping concerns

Agencies
November 18, 2019

If someone has sent you an MP4 file on WhatsApp, guard against downloading it as hackers may use a critical vulnerability in the Facebook-owned app to execute snooping attack on both Android and iOS devices.

The specially crafted MP4 file triggers the remote code execution (RCE) and denial of service (DoS) cyber attack.

"The vulnerability is classified as 'Critical' severity that affected an unknown code block of the component MP4 File Handler in WhatsApp," reported gbhackers.com on Saturday.

Facebook has issued an advisory, saying "A stack-based buffer overflow could be triggered in WhatsApp by sending a specially crafted MP4 file to a WhatsApp user.

"The issue was present in parsing the elementary stream metadata of an MP4 file and could result in a DoS or RCE."

The news comes on the heels of an Israeli software Pegasus by cyber intelligence company NSO Group that exploited its video calling system to snoop on 1,400 selected users globally and in India, including human rights activists and journalists.

The issue snowballed into a political one and the Indian government denied either purchasing or planning to purchase the infamous software in question.

"We agree with the government of India's strong statement about the need to safeguard the privacy of all Indian citizens. That is why we've taken this strong action to hold cyber attackers accountable and why WhatsApp is so committed to the protection of all user messages through the product we provide," a WhatsApp spokesperson had said in a statement.

The new vulnerability is found in Android versions prior to 2.19.274; iOS versions prior to 2.19.100; Enterprise Client versions prior to 2.25.3; Business for Android versions prior to 2.19.104; Business for iOS versions prior to 2.19.100; and Windows Phone versions before and including 2.18.368.

Hackers can use the WhatsApp vulnerability to deploy the malware on the user's device to steal sensitive files and also used to surveillance purpose.

"The RCE vulnerability allows hackers to perform the attack remotely without any sort of authentication," claimed the report.

The critical WhatsApp vulnerability can be tracked as CVE-2019-11931.

Comments

Add new comment

  • Coastaldigest.com reserves the right to delete or block any comments.
  • Coastaldigset.com is not responsible for its readers’ comments.
  • Comments that are abusive, incendiary or irrelevant are strictly prohibited.
  • Please use a genuine email ID and provide your name to avoid reject.
Agencies
January 3,2020

Giving each and every app access to personal information stored on Android smartphones such as your contacts, call history, SMS and photos may put you in trouble as bad actors can easily use these access to spy on you, send spam messages and make calls anywhere at your expense or even sign you up for a premium "service", researchers from cybersecurity firm Kaspersky have warned.

But one can restrict access to such information as Android lets you configure app permissions. 

Giving an app any of these permissions generally means that from now on it can obtain information of this type and upload it to the Cloud without asking your explicit consent for whatever it intends to do with your data.

Therefore, security researchers recommend one should think twice before granting permissions to apps, especially if they are not needed for the app to work. 

For example, most games have no need to access your contacts or camera, messengers do not really need to know your location, and some trendy filter for the camera can probably survive without your call history, Kaspersky said. 

While decision to give permission is yours, the fewer access you hand out, the more intact your data will be.

Here's what you should know to protect your data.

SMS: An app with permission to send and receive SMS, MMS, and WAP (Wireless Application Protocol) push messages, as well as view messages in the smartphone memory will be able to read all of your SMS correspondence, including messages with one-time codes for online banking and confirming transactions.

Using this permission, the app can also send spam messages in your name (and at your expense) to all your friends. Or sign you up for a premium "service." You can see and conrol which apps have these rights by going to the settings of your phone.

Calendar: With permission to view, delete, modify, and add events in the calendar, prying eyes can find out what you have done and what you are doing today and in the future. Spyware loves this permission.

Camera: Permission to access the camera is necessary for the app to take photos and record video. But apps with this permission can take a photo or record a video at any moment and without warning. Attackers armed with embarrassing images and other dirt on you can make life a misery, according to Kaspersky.

Contacts: With permission to read, change, and add contacts in your address book, and access the list of accounts registered in the smartphone, an app can send your entire address book to its server. Even legitimate services have been found to abuse this permission, never mind scammers and spammers, for whom it is a windfall.

This permission also grants access to the list of app accounts on the device, including Google, Facebook, and many other services.

Phone: Giving access to your phone means permission to view and modify call history, obtain your phone number, cellular network data, and the status of outgoing calls, add voicemail, access IP telephony services, view numbers being called with the ability to end the call or redirect it to another number and call any number.

This permission basically lets the app do anything it likes with voice communication. It can find out who you called and when or prevent you from making calls (to a particular number or in general) by constantly terminating calls. 

It can eavesdrop on your conversations or, of course, make calls anywhere at your expense, including to pay-through-the-nose numbers, Kaspersky warned.

Comments

Add new comment

  • Coastaldigest.com reserves the right to delete or block any comments.
  • Coastaldigset.com is not responsible for its readers’ comments.
  • Comments that are abusive, incendiary or irrelevant are strictly prohibited.
  • Please use a genuine email ID and provide your name to avoid reject.
Agencies
July 13,2020

New Delhi, Jul 13: The Income Tax Department has facilitated a new functionality for banks and post offices to ascertain TDS applicability rates on cash withdrawal of above Rs 20 lakh in case of a non-filer of the income-tax return and that of above Rs 1 crore in case of a filer of the income-tax return.

In a statement, the Central Board of Direct Taxes (CBDT) said that now banks and post offices have to only enter the PAN of the person who is withdrawing cash for ascertaining the applicable rate of TDS.

So far, more than 53,000 verification requests have been executed successfully on this facility, a statement by the CBDT said.

"CBDT today said that this functionality available as 'Verification of applicability u/s 194N' on www.incometaxindiaefiling.gov.in since 1st July 2020, is also made available to the Banks through web-services so that the entire process can be automated and be linked to the Bank's internal core banking solution," it said.

On entering PAN by the bank or the post office, a message will be instantly displayed on the departmental utility: "TDS is deductible at the rate of 2 per cent if cash withdrawal exceeds Rs 1 crore", in case the person withdrawing cash is a filer of the income-tax return.

In case the person withdrawing cash is a non-filer of income tax return, the message shown would be: "TDS is deductible at the rate of 2 per cent if cash withdrawal exceeds Rs 20 lakh and at the rate of 5 per cent if it exceeds Rs 1 crore."

The CBDT said that the data on cash withdrawal indicated that huge amount of cash is withdrawn by the persons who have never filed income-tax returns.

To ensure filing of return by these persons and to keep track on cash withdrawals by the non-filers, and to curb black money, the Finance Act, 2020 with effect from July 1, 2020 further amended IT Act to lower threshold of cash withdrawal to Rs 20 lakh for the applicability of this TDS for the non-filers and also mandated TDS at the higher rate of 5 per cent on cash withdrawal exceeding Rs 1 crore by the non-filers.

Comments

Add new comment

  • Coastaldigest.com reserves the right to delete or block any comments.
  • Coastaldigset.com is not responsible for its readers’ comments.
  • Comments that are abusive, incendiary or irrelevant are strictly prohibited.
  • Please use a genuine email ID and provide your name to avoid reject.
Agencies
July 24,2020

Pune, Jul 24: Agile and dexterous, 85-year-old Shantabai Pawar wields sticks with absolute ease as she displays 'lathi-kathi' on the streets of Pune.

A video of her, displaying her skills in the Indian martial art form for livelihood, has gone viral on social media.

Pawar told media persons that she learnt the art form when she was only eight and has been practising it since then. The ancient martial art s believed to be linked to Dombari community, a nomadic tribe in Maharashtra.

"I have been pursuing the art of lathi-kathi since I was eight. I have never left it. It is part of me and it is an honour to practice it. My father taught me this. He taught me to work hard," Pawar told media persons.

In the video, the sari-clad octogenarian takes a warrior-like stride and effortlessly rotates a stick several times in a second in her hand and around her head and then does it with two sticks together with a smile on her face. She also tosses a stick in the air and catches it with ease.

The assembled gathering is impressed and enthused.

"People come and say, 'Well done Daadi!' I practice it to earn money for my children and grandchildren," she said.

Pawar leaves her home in the morning in the conditions created by coronavirus and performs the art form on roads and streets.

"I go to various areas to perform the art form and people give money," she said.

The artiste also uses thali and stick to gather the attention of people as most of them are indoors due to conditions created by COVID-19.

Senior citizens have been advised against venturing out due to their greater susceptibility to coronavirus but Pawar said she is not afraid to step out.

"People do advise me to not go out due to fear of COVID-19 but I am not scared. Whenever I step out, I pray to my God and he has kept me safe so far," she said.

Aishwarya Kale, a dancer and the person who uploaded the video on social media, said that it is "only an artist who can understand what help another artist needs".

"I was in that area shopping for some items and it was then I saw her performing and thought that I should film her and upload her video on social media. But I never thought that the video would go viral and she would receive financial help not just from people in the country but overseas as well," Kale told media persons.

"She is now getting honour for her craft that she couldn't get in the last 85 years. I feel good that through my small video, her art form has become viral," she added. 

Comments

Add new comment

  • Coastaldigest.com reserves the right to delete or block any comments.
  • Coastaldigset.com is not responsible for its readers’ comments.
  • Comments that are abusive, incendiary or irrelevant are strictly prohibited.
  • Please use a genuine email ID and provide your name to avoid reject.