Tens of thousands of WhatsApp messages unprotected and freely accessible online
Created: 12/14/2021, 05:27 PM
Thousands of WhatsApp messages lay virtually unprotected on the Internet for a year.
(Symbol picture) © Fabian Sommer / dpa
Several thousand WhatsApp messages were unprotected on the Internet for around a year.
A security gap at the Munich startup Zapptales was responsible for this.
Munich - "With Zapptales you can create a unique book from your favorite chat (...)", advertises the startup of the same name on its website.
The offer from the young company is actually as simple as it is nice.
It turns a digital, private conversation from a messenger service such as WhatsApp, Instagram, Facebook or Threema into a hardback book for analogue memories.
The whole thing is similar to a photo book including the entire conversation of the chat.
A nice present.
But something almost went wrong.
The vulnerability apparently remained undetected
In September of this year, IT security experts from the Zerforschung group found a major vulnerability in the app.
According to
spiegel.de
, they reported their findings to the responsible authorities.
Among other things, the chat logs, media from the chats and PDFs of the chat books could be viewed.
The report, which was sent to the Federal Office for Information Security (BSI) and the responsible Bavarian state data protection supervisory authority and which
was available
to
Spiegel
, further shows that hackers could have viewed a large amount of private data through the security gap.
"Had" because the security gap was apparently not exploited.
Lucky - the vulnerability was not exploited
Zapptales confirmed the vulnerability. "Fortunately, the good news is now taking hold," the company continues. “In fact, no customer data was affected and we fixed the vulnerability immediately. So there is nothing to worry about for our customers. "
According to
spiegel.de
, managing director Anna Kimmerle-Hürlimann explains that the vulnerability was not used
.
They closed the gap within two hours of receiving the report.
The next day, a new version of the software continued to be released that completely resolved the problem.
The security researchers are grateful that they found the hole and that it could be closed so quickly.