What’s Vulnerable in WhatsApp

Author Name(s): Sumitra Biswal, Vishal Gupta
Author Email: sbiswal2912@gmail.com


The advent of Smartphones and their quick time services have made the urban lifestyle convenient and close-knit. Smartphone users can now reach their closed ones instantaneously via audio-video and messages. The Over-The-Top (OTT) applications have connected the users worldwide and bridged the gaps amidst scattered relations. While OTT applications have turned out to be blissful for dispersed relatives and have helped various commercial relations thrive, their security has never been well addressed. It is evident owing to multiple such applications emerging at a faster scale with Quality of Service (QoS) prioritized over security. The paper highlights certain major vulnerabilities and security flaws of the most popular OTT application, WhatsApp. This paper also acknowledges existing work pertaining to security of WhatsApp and similar web applications. In this paper we highlight an unaddressed vulnerability of WhatsApp that users are interestingly, not aware of. Besides, we also propose a novel method to ensure security of WhatsApp and akin applications against this silent-yet-deadly vulnerability discovered.


The field of communication has evolved over time at a fast pace. The era of using Pigeons and Horses for communication has gradually been replaced by Postal means via roads, seas and airways. Sooner, the duration of transaction of messages was shortened with the Computer era. E-mails took over the industry thereby, reducing years and months to hours and minutes. But evolution did not stop there. The hooping increase in use of Smartphones and akin devices reflects the fast growth of urban and remote lifestyles. The Smartphone users are able to communicate worldwide within fraction of seconds. Number of successful business deals, transaction of money, goods and services are possible within no time; thanks to Smart technologies. Such technologies that have not only enabled text messages, but also audio and video calls over the same device with minimal infrastructure requirements are popularly known as Over-The-Top (OTT) applications. The worldwide use of such applications has certainly helped them bloom over a short time period. However, IT has not only helped people communicate at ease, but also, has opened avenues for miscreants to sniff communications by unauthorized means. Thus, insecurities and threats have crept in through the doors of convenience opened by OTT and other web applications for the users. OTT and web applications were developed solely to facilitate communication amidst users. Preliminary applications never envisaged the vulnerabilities. Lately, such applications have been flooding the IT market. In order to win in this fierce battle of survival, these applications tend to address the Quality of Service (QoS) aspect alone, neglecting security aspects. Apparently, generic users seek high QoS, low latency in communication, high speed and high throughput in the shortest possible time. The application meeting all these criteria turns out to be clear winner and emerges popular worldwide. Such features are practically feasible with the classic tradeoff concept amidst QoS and security. The higher the security, lower is the accuracy and QoS. Hence, developers have been compromising security aspect in order to thrive in IT business.


It is inferred that, a secure and robust registration and authentication architecture of WhatsApp and similar web applications can curb the potential threats to a major level. As we observed, a minimalistic hacking attempt is possible owing to OTP on Call feature, it is concluded that, the proposed security architecture can bring in a revolution in the security protocol of the application. The intricate steps of confirmation involved are onetime activities. Hence, it is concluded that, these extensive steps will not hamper the regular use of the application once it has been genuinely registered. Furthermore, it is highlighted in (McCarty, 2011), how a hijacked WhatsApp user remains unaware of the account signup on other device

474 total views, 1 views today

Download PDF File

About the author: admin