Attackers use voicemail hack to steal WhatsApp accounts

Another online account hijacking attack has emerged, this time targeting WhatsApp. The Israeli agency responsible for cybersecurity has warned its citizens about the attack, which can often be conducted without any knowledge or interaction on their part. All the attacker needs is the victim’s phone number.

First documented by security researchers last year, the security flaw has now hit the mainstream. Last week, ZDNet reported that the Israeli National Cybersecurity Authority issued an alert warning that WhatsApp users could lose control of their accounts.

The hack capitalises on users’ tendency not to change default access credentials on cellphone voicemail numbers. The attacker makes a request to register the victim’s telephone number to the WhatsApp application on their own phone. By default, WhatsApp sends a six-digit verification code in an SMS text message to the victim’s phone number, to verify that the person making the request owns it.

Ideally, the victim would see the message, alerting them that something was up. The attacker avoids that by launching the attack at a time when the victim would not answer their phone, such as in the middle of the night, or while they are on a flight. Many users may even have their phones set to ‘do not disturb’ during this time.

The attacker doesn’t have access to the victim’s phone, and so cannot see the code to enter it. WhatsApp then offers to call the victim’s number with an automated phone message reading out the code. Because the victim is not accepting calls, the automated message is left as a voicemail.

The attacker then exploits a security flaw on many carrier networks, which provide generic telephone numbers that users can call to access voicemail. The only credential required to hear the voicemail is a four-digit PIN, and many carriers set this by default to something simple like 0000 or 1234. These default passwords are easily discovered online.

When the attacker uses the default PIN to access the victim’s voicemail, they can hear the code and then enter it into their own device, completing the transfer of the victim’s phone number to their own WhatsApp account.

To seal the deal, the attacker can then enable two-step verification, which is an optional feature that WhatsApp has been offering since 2017. This requires the user to set a custom PIN, which they must then re-enter if they wish to reverify their phone number. Turning on this feature prevents the victim from regaining control over their own phone number.

Security researcher Martin Vigo explored and expanded on automated phone message attacks in a talk at DEF CON this August titled “Compromising online accounts by cracking voicemail systems”. He went beyond simple default voicemail PINs, using a Python script that brute-forced voicemail accounts using the cloud-based telephony API Twilio.

During the talk, he called out several online services that he said were vulnerable to attacks like this. PayPal, Netflix, Instagram and LinkedIn supported password reset by automated phone call, he said, adding that Apple, Google, Microsoft and Yahoo support the use of automated voicemails for two-factor authentication (2FA).

In a blog post describing the talk, he lamented the fact that we’re still using 30 year-old technologies to secure sensitive systems.

How can you protect your WhatsApp and other accounts from hijackers?

Using application-based 2FA (such as Sophos Authenticator, which is also included in our free Sophos Mobile Security for Android and iOS) mitigates a lot of the risk, because these mobile authentication apps don’t rely on communications tied to phone numbers.

If you must use a service that relies on automated voice messages, then set a strong PIN for your voicemail inbox.

Finally, enable two-step verification on your WhatsApp account, by opening WhatsApp and going to Settings > Account > Two-step verification > Enable.