WhatsApp Isn’t as Secure as You Think: Report

• WhatsApp says it’s a very secure app because it has end-to-end encryption.
• A new report from the Mobile Security Framework says WhatsApp is not secure.
• The analysis found 25 problems with a high risk and 94 problems with a medium risk.

WhatsApp says it’s a very secure app because it has end-to-end encryption, lots of privacy features, and more, but a new report from Mobile Security Framework says that’s not true.

MobSF is an automated, all-in-one mobile application for pen-testing, malware analysis, and security assessment framework that works on Android, iOS, and Windows. It can do both static and dynamic analysis. Its most recent report on WhatsApp shows that Meta’s chat app is a high-risk platform, with a security score of 39/100, giving it a C grade.

The analysis found 25 problems with a high risk and 94 problems with a medium risk. Most of these were about what permissions WhatsApp needs and how much information it can read from your phone.

For example, the messaging app can read both your general location and your GPS location, which, according to the report, can be used by malicious apps to find out where you are and also drain your battery power.

It can also read your phone’s status and identity, receive and process SMS, and show system-level alerts, which would let malicious apps take over the whole screen.

Down the list, there is a long list of high-risk permissions, such as the ability to read your phone’s external storage or collect your entire camera roll.

The report also says that the app’s launch mode activity shouldn’t be set to “singleTask/singleInstance,” since that lets other apps read intent and puts sensitive data at risk.

Also Read

Infinix HOT 20 Series May Arrive in Pakistan; 810 SoC, 120Hz LCD

The Hot 20 is the most affordable 5G phone with the Dimensity...

The launch mode attribute of an Activity shouldn’t be set to “singleTask/singleInstance,” because that makes the Activity the root Activity and makes it possible for other apps to read the contents of the calling Intent. So, you have to use the “standard” launch mode attribute when an Intent has sensitive information.

Many of these obvious problems were already pointed out in an update to WhatsApp’s privacy policy last year, which made millions of people switch to other apps like Telegram and Signal. But this new analysis from MobSF also finds important technical details.