New WhatsApp bug via MP4 file triggers snooping concerns

Agencies
November 18, 2019

If someone has sent you an MP4 file on WhatsApp, guard against downloading it as hackers may use a critical vulnerability in the Facebook-owned app to execute snooping attack on both Android and iOS devices.

The specially crafted MP4 file triggers the remote code execution (RCE) and denial of service (DoS) cyber attack.

"The vulnerability is classified as 'Critical' severity that affected an unknown code block of the component MP4 File Handler in WhatsApp," reported gbhackers.com on Saturday.

Facebook has issued an advisory, saying "A stack-based buffer overflow could be triggered in WhatsApp by sending a specially crafted MP4 file to a WhatsApp user.

"The issue was present in parsing the elementary stream metadata of an MP4 file and could result in a DoS or RCE."

The news comes on the heels of an Israeli software Pegasus by cyber intelligence company NSO Group that exploited its video calling system to snoop on 1,400 selected users globally and in India, including human rights activists and journalists.

The issue snowballed into a political one and the Indian government denied either purchasing or planning to purchase the infamous software in question.

"We agree with the government of India's strong statement about the need to safeguard the privacy of all Indian citizens. That is why we've taken this strong action to hold cyber attackers accountable and why WhatsApp is so committed to the protection of all user messages through the product we provide," a WhatsApp spokesperson had said in a statement.

The new vulnerability is found in Android versions prior to 2.19.274; iOS versions prior to 2.19.100; Enterprise Client versions prior to 2.25.3; Business for Android versions prior to 2.19.104; Business for iOS versions prior to 2.19.100; and Windows Phone versions before and including 2.18.368.

Hackers can use the WhatsApp vulnerability to deploy the malware on the user's device to steal sensitive files and also used to surveillance purpose.

"The RCE vulnerability allows hackers to perform the attack remotely without any sort of authentication," claimed the report.

The critical WhatsApp vulnerability can be tracked as CVE-2019-11931.

Comments

Add new comment

  • Coastaldigest.com reserves the right to delete or block any comments.
  • Coastaldigset.com is not responsible for its readers’ comments.
  • Comments that are abusive, incendiary or irrelevant are strictly prohibited.
  • Please use a genuine email ID and provide your name to avoid reject.
Agencies
June 13,2020

The Brazilian government said that the Amazon rainforest witnessed deforestation of a record 829 sq km in May, the highest monthly level since 2015.

On Friday, the National Institute for Space Research (INPE) said that deforestation in the Amazon increased by 91 sq km compared to the same period last year, reports Xinhua news agency.

Between January and April, destruction of the forest by illegal loggers and ranchers rose 55 per cent, or a total of 1,202 sq km was wiped out, it said.

The Real-time Deforestation Detection system, a federal project created to monitor human activity in the Amazon, alerted authorities to the increase in the rate of destruction of the rainforest.

A recent study by the Amazon Environmental Research Institute (IPAM) warned that deforestation in 2020 could reach 11,900 sq km if the pace of May, June, and July follows the historical average.

Deforestation in the region has soared since President Jair Bolsonaro took office last year, according to conservation groups.

He has argued that more farming and mining in protected areas of the forest were the only way to lift the region out of poverty.

Bolsonaro's environmental policies have been widely condemned but he has rejected the criticism, saying Brazil remains an example for conservation.

Comments

Add new comment

  • Coastaldigest.com reserves the right to delete or block any comments.
  • Coastaldigset.com is not responsible for its readers’ comments.
  • Comments that are abusive, incendiary or irrelevant are strictly prohibited.
  • Please use a genuine email ID and provide your name to avoid reject.
Agencies
May 30,2020

The GST Council is unlikely to make major changes in the indirect tax structure at its next meeting slated mid June.

A top government source said that the Centre is not in favour of increasing tax rates on any goods or service as it could further impact consumption and demand that is already suppressed due the COVID-19 pandemic and lockdown.

It was widely expected that the GST Council could consider raising tax rates and cess on certain non-essential items to boost revenue for states and the Centre. Several states have reportedly taken an over 80-90 per cent hit in GST collections in April, the official data for which has not yet been released by the Centre.

"The need of the hour is to boost consumption and improve demand. By categorising items into essential and non-essential and then raising taxes on non-essential is not what Centre favours. But, the issue on rates and relief will be decided by the GST Council that is meeting next month," the finance ministry official source quoted above said.

The GST Council is chaired by the Union finance minister and thus the views of the Centre play out strongly in the council meetings.

However, the Council will also have to balance the expectations of the states whose revenues have nosedived after the coronavirus outbreak and wide scale disruption to businesses while they have still not been paid GST compensation since the December-January period.

To the question of wider scale job losses in the period of lockdown as businesses get widely impacted, the official said that the Finance Ministry has asked the labour ministry to collect data on job losses during Covid-19 and is constantly engaging with the ministry to oversee job losses and salary cuts.

On restrictions put on Chinese investment in India, the official clarified that no decision had yet been taken to restrict China through the Foreign Portfolio Investment (FPI) route.

Asked about monetising government debt, the official said that the issue would be looked at when we reach a stage. It has not come to that stage yet.

In the government's over Rs 20 lakh crore economic package, the official defended its structure while suggesting that comparisons with the economic packages of other countries should not be drawn as India's needs were different from others.

"We have gone in more reforms that is needed to give strength to the economy. This is required more in our country," the official source said.

Comments

Add new comment

  • Coastaldigest.com reserves the right to delete or block any comments.
  • Coastaldigset.com is not responsible for its readers’ comments.
  • Comments that are abusive, incendiary or irrelevant are strictly prohibited.
  • Please use a genuine email ID and provide your name to avoid reject.
Agencies
May 14,2020

Social media platform WhatsApp assured the Supreme Court on Wednesday that it will not roll out its payment services without complying with all payment regulations and norms in the country.

A bench headed by Chief Justice S.A. Bobde and comprising Justices Indu Malhotra and Hrishikesh Roy took up the matter through video conferencing. Senior advocate Kapil Sibal, representing the social media platform, said "WhatsApp Inc makes a statement on behalf of his client that they will not go ahead with the payments' scheme without complying with all the regulations in force."

The statement was made during the hearing of a petition seeking a ban on payment through WhatsApp, as it does not conform to the data localization norms. The top court took the assurance made by WhatsApp on record.

WhatsApp made the statement during the hearing of a plea seeking a ban on its payment service, for not being in line with data localization norms.

In 2018, WhatsApp was granted a beta licence to launch its payment service, but a dedicated and separate app is yet to be launched. A petition was moved in the apex court that WhatsApp's existing model for its payments service should be declared inconsistent with the Unified Payment Interface (UPI) Scheme, as a separate dedicated app has not been offered by the company.

The petitioner NGO, Good Governance Chambers, argued that the National Payments Corporation of India (NPCI) and the Reserve Bank of India (RBI) must change its model on the lines of the UPI payment scheme, and its operations may be suspended until these conditions are met.

The apex court today asked the Centre, Facebook and WhatsApp to file their replies within three weeks and it will take up the matter thereafter. The court noted that the government may process the applications filed by WhatsApp in accordance with the law and there is no stay on the same. Facebook was represented by senior advocate Arvind Datar.

The petitioner argued that lapses have been found in relation to WhatsApp's claims of having a secure and safe technological interface for securing sensitive user data.

Comments

Add new comment

  • Coastaldigest.com reserves the right to delete or block any comments.
  • Coastaldigset.com is not responsible for its readers’ comments.
  • Comments that are abusive, incendiary or irrelevant are strictly prohibited.
  • Please use a genuine email ID and provide your name to avoid reject.