(In)Secure Messaging Apps: A Lateral Movement Into Your Privacy
summary
Reverse engineering of a Python info‑stealer finds code targeting Telegram cache and a PBKDF2 key derivation using 4000 iterations, proving desktop session material is harvestable; Electron‑based clients share on-disk session structures so copying files restores full access. Signal and Telegram accept copied sessions creating competing sessions, WhatsApp’s UI warning is bypassable by killing network then rejoining (proofs of concept run successfully), and Android clones use an SMS race condition to spawn phantom sessions. Vendors are notified.
AI-written summary · about
chapters (6)
- 0:00Introduction and background
- 4:22Discovery of Telegram cache malware
- 10:20Session hijacking across messaging apps
- 17:51Zero-day in WhatsApp session handling
- 23:41Why these vulnerabilities matter
- 28:41Final thoughts and Q&A
related talks
23mReverse Engineering WhatsApp Encryption for Chat Manipulation and More
49mInside the Information Stealer Ecosystem: From Compromise...
01h 07mBuilding Rock-Solid Encrypted Applications
49mEffects of Weaponized Malware on End-to-End Encryption and Exfiltrating Data from Signal Messenger
29mPwning WhatsApp The Dark Side Of Web based Messaging Apps
19mBuilding private products
42mSecurity of Push Messaging
19mPrekey Pogo: Investigating Security and Privacy Issues in WhatsApp's Handshake Mechanism