On July 15, cybersecurity firm Symantec revealed that attackers can manipulate users’ WhatsApp and Telegram media files on Android because of a ‘Media File Jacking’ flaw in the apps. It affects WhatsApp for Android by default, and Telegram for Android if certain features are enabled. “It stems from the lapse in time between when media files received through the apps are written to the disk, and when they are loaded in the apps’ chat user interface (UI) for users to consume,” Symantec said. How does this flaw work? WhatsApp, by default, saves received media files in external storage. On Android devices, files saved to external storage are “world-readable/writeable, so they can be modified by other apps or users beyond the app's control”, while files saved to internal storage can be accessed only by the app itself. Similarly, in Telegram, if a user enables ‘Save to Gallery’ feature, files will be saved in external storage. Consequently, when these files are saved to external storage, other apps with write-to-external storage permission can potentially manipulate these media files. Symantec found that nearly 50% of a given device’s apps have this permission. Here's what WhatsApp told MediaNama: “WhatsApp has looked closely at this issue and it’s similar to previous questions about mobile device storage impacting the app ecosystem. WhatsApp follows current best practices provided by operating systems for media storage and looks forward to providing updates in line with Android’s ongoing development. The suggested changes here could both create privacy complications for our users…
- ONDC September Round-Up: AI, grievance redressal, financial services, Google, exports, and more September 30, 2023
- ‘The Liver Doctor’ X account suspended following defamation case by Himalaya Wellness Corporation September 29, 2023
- Bombay HC to Pronounce Judgment on Fact Check Amendment on December 1st, Stay on Notification to Continue Until Then September 29, 2023
- Here’s how web publishers can opt out of Google crawlers scraping website data to train AI models September 29, 2023
- Parliament Standing Committee Calls For A Monitoring Group To Check Technological Readiness For Digital Education Projects September 29, 2023
MediaNama’s mission is to help build a digital ecosystem which is open, fair, global and competitive.
Factors like Indus not charging developers any commission for in-app payments and antitrust orders issued by India's competition regulator against Google could contribute to...
Is open-sourcing of AI, and the use cases that come with it, a good starting point to discuss the responsibility and liability of AI?...
RBI Deputy Governor Rabi Shankar called for self-regulation in the fintech sector, but here's why we disagree with his stance.
Straw man fallacy: IT Ministers’ defence of government exemptions in data protection law misses the point
Both the IT Minister and the IT Minister of State have chosen to avoid the actual concerns raised, and have instead defended against lesser...
The Central Board of Film Certification found power outside the Cinematograph Act and came to be known as the Censor Board. Are OTT self-regulating...
Please subscribe to MediaNama. Don't share prints and PDFs.
You May Also Like
Google has released a Google Travel Trends Report which states that branded budget hotel search queries grew 179% year over year (YOY) in India, in...
135 job openings in over 60 companies are listed at our free Digital and Mobile Job Board: If you’re looking for a job, or...
Twitter takes down tweets from MP, MLA, editor criticising handling of pandemic upon government request
By Aroon Deep and Aditya Chunduru You’re reading it here first: Twitter has complied with government requests to censor 52 tweets that mostly criticised...