WhatsApp, the world's most popular end-to-end encrypted messaging application, patched an incredibly frustrating software bug that could have allowed a malicious group member to crash the messaging app for all members of the same group, The Hacker News learned.

Just by sending a maliciously crafted message to a targeted group, an attacker can trigger a fully-destructive WhatsApp crash-loop, forcing all group members to completely uninstall the app, reinstall it, and remove the group to regain normal function.

Since the group members can't selectively delete the malicious message without opening the group window and re-triggering the crash-loop, they have to lose the entire group chat history, indefinitely, to get rid of it.

Discovered by researchers at Israeli cybersecurity firm Check Point, the latest bug resided in the WhatsApp's implementation of XMPP communication protocol that crashes the app when a member with invalid phone number drops a message in the group.

"When we attempt to send a message where the parameter 'participant' receives a value of 'null,' a 'Null Pointer Exception' is thrown," the researchers explain in a report shared with The Hacker News prior to its release.

"The parser for the participant's phone number mishandles the input when an illegal phone number is received. When it receives a phone number with a length, not in the ranger 5-20 or a non-digit character, it would read it as a 'null' string."

The attack requires a malicious group member to manipulate other parameters associated with messages in a conversation that is otherwise protected using end-to-end encryption.
In order to carry out this attack, an attacker can leverage WhatsApp Web and a web browser debugging tool in combination with an open source WhatsApp manipulation tool that Check Point released last year.

The WhatsApp manipulation tool is an extension for Burp Suite penetration testing software that allows users to intercept, decrypt, and re-encrypt their WhatsApp communication using their own encryption keys.

As shown in the video demonstration, the researchers used this setup to trigger the crash bug against all members of a group by simply replacing the participant's parameter from the sender's phone number to 'a@s.whatsapp.net,' an invalid non-digit phone number.

"The bug will crash the app, and it will continue to crash even after we reopen WhatsApp, resulting in a crash loop," the researchers say.

"Moreover, the user will not be able to return to the group and all the data that was written and shared in the group is now gone for good. The group cannot be restored after the crash has happened and will have to be deleted in order to stop the crash."

It should be noted that the attack would not affect the sender since the malicious message was injected in transit after it left the sender's device.

Check Point responsibly reported this crash bug to the WhatsApp security team back in late August this year, and the company patched the issue with the release of WhatsApp version 2.19.58 in mid-September.

The WhatsApp developers also "added new controls to prevent people from being added to unwanted groups to avoid communication with untrusted parties altogether."

"Because WhatsApp is one of the world's leading communication channels for consumers, businesses and government agencies, the ability to stop people using WhatsApp and delete valuable information from group chats is a powerful weapon for bad actors," Oded Vanunu, Check Point's Head of Product Vulnerability Research said.

WhatsApp users are highly recommended to always keep their apps up-to-date in order to protect themselves against known attacks.