WhatsApp’s view once privacy flaw: exploited and abusable

WhatsApp’s “View Once” feature, designed to enhance privacy by allowing users to share disappearing photos and videos, has come under fire due to a critical security flaw. This flaw has been actively exploited by malicious actors, compromising the privacy and security of WhatsApp users.
Flaw Details
The core issue in WhatsApp’s implementation of the “View Once” feature lies in several vulnerabilities:

• Unrestricted Access to Companion Devices: View Once messages are sent to all recipient devices, including web applications, where they are vulnerable to manipulation.
• Flag Manipulation: Attackers can modify the “View Once” flag to “false,” converting the message into a regular downloadable media file.
• Unsecured Content URLs: Media URLs for View Once messages do not require authentication for download.
• Persistent Low-Quality Preview: Some View Once messages contain a low-quality preview that can be viewed without downloading the original media.
• Delayed Deletion from Servers: View Once media is not immediately deleted from WhatsApp’s servers after being downloaded, remaining accessible for up to two weeks.
  Exploitation and Consequences
  Attackers have taken advantage of these vulnerabilities by developing modified WhatsApp apps and web extensions that exploit the flag manipulation technique. These tools allow them to save and distribute View Once media without the sender’s consent.
  This exploit has severe consequences:
• Privacy Breach: View Once media may not be as private as users believe, as attackers can capture and distribute it without attribution.
• Malicious Content Distribution: Attackers can distribute malware or other malicious content disguised as View Once messages.
• Attribution Concealment: The lack of user consent and attribution makes it difficult to identify and hold attackers responsible.
  Mitigation and Recommendations
  To address this flaw, WhatsApp must implement the following measures:
• Proper Digital Rights Management (DRM): Verify hardware support for DRM to enforce the View Once limitation.
• Restrict Companion Device Access: Send View Once messages only to the primary mobile device, excluding linked devices.
  Until the flaw is fixed, users should be cautious about using the “View Once” feature:
• Be Aware of Privacy Concerns: Recognize that View Once media may not be as private as intended.
• Limit Usage: Avoid sharing sensitive information through View Once messages.
• Consider Other Options: Explore alternative apps or encryption tools that provide stronger privacy and control over disappearing media.
  Conclusion
  The exploitation of WhatsApp’s View Once privacy flaw highlights the importance of diligent security practices. WhatsApp must prioritize user privacy by implementing comprehensive security measures. Users should remain vigilant until the flaw is addressed, taking steps to protect their data and avoid potential misuse.