TECH
news
Check Point reveals: Weakness on Instagram has turned the smartphone into a spy tool
The weakness was detected by Check Point in the image processing mechanism of the popular platform, and allowed the attacker to take control of the app as well as obtain the victim's location, contact information, camera activation and more.
Tags
Instagram
Mikey Levy
Thursday, September 24, 2020, 1:00 p.m.
Share on Facebook
Share on WhatsApp
Share on general
Share on general
Share on Twitter
Share on Email
0 comments
Check Point's cyber defense researchers have identified a serious security vulnerability in one of the most popular applications in the world - Instagram.
The weakness in the app, which has more than a billion users around the world, existed in the code of one of the libraries used by Instagram - Mozjpeg - which allows photos to be uploaded to the app.
The vulnerability has allowed potential remote control of the application and the phone where it is stored using the Remote Control Execution (RCE) method.
Upon gaining remote control, the attacker can use the phone device as its own and turn it into a spy device for anything and everything, in a way that makes the attacker accessible to all the information on the device and its various capabilities.
"Popular apps are considered 'golden targets' for large countries and attackers, as they contain a lot of personal information about them, as well as a particularly long series of permissions and accessibility on the device on which they are installed. In this respect, weakness in such an app is particularly dangerous." Yaniv Belmes, Director of the Cyber Research Department at Check Point.
"Many users do not even look at the permissions they allow for apps, and we recommend doing so to ensure they are aware of the risk they are taking," he added.
More on Walla!
NEWS
"People from all over the world are calling to ask which conditioner to use": The network mocks Benjamin Netanyahu
To the full article
Check Point researchers updated Facebook on the vulnerability in February and the company dealt with the issue quickly, using a security update designed to block the vulnerability in updated versions of Instagram.
Due to the fact that this is a serious weakness in a popular app and that it is a non-automatic update and requires users to download it, Check Point waited six months with the publication (three months beyond the usual time to update and address vulnerabilities until publication) to reduce the potential risk of the vulnerability.
Weakness on Instagram has turned the smartphone into a spy tool (Photo: ShutterStock)
Sending an image with malicious code: this is how the attack worked
The attack worked by the attacker sending an image containing malicious code to the victim via email, WhatsApp, SMS or any other communication platform.
The image is saved on the mobile device automatically or manually, (automatic options can be for example the default setting for downloading WhatsApp images, the default setting for receiving an image via Android SMS or the default setting for receiving an image by email on Android).
The victim opens the Instagram app for normal use and thus initializes the exploitation of the weakness, in a way that allows for taking over the device.
The control over the victim's Instagram and the device on which it is stored due to the weakness is extensive, due to the fact that the app asks for many permissions on the device on which it is stored, and allows the attacker to access many capabilities of the mobile device - from victim location and camera activation. Stored on the device.
Also, exploiting the vulnerability makes it possible to crash the app and disable it until it is deleted from the device.
Share on Facebook
Share on WhatsApp
Share on general
Share on general
Share on Twitter
Share on Email
0 comments
