Panda Security specializes in the development of endpoint security products and is part of the WatchGuard portfolio of IT security solutions. Initially focused on the development of antivirus software, the company has since expanded its line of business to advanced cyber-security services with technology for preventing cyber-crime. As long as interconnects link SS7, Diameter, and IMS networks, SMS-based attacks are not going away.
WeChat’s mini-programs, used by over 1.2 billion users, operate in a dual-thread architecture. JavaScript logic and rendering layers are isolated, preventing cross-layer privilege escalation. For example, rendering-layer APIs like insertVideoPlayer cannot access high-risk functions such as saveFile, reducing the impact of cross-site scripting (XSS) vulnerabilities, researchers said. This represents a significant escalation in instant messaging security threats, particularly affecting the platform’s hundreds of millions of users worldwide. GBHackers on Security is a top cybersecurity news platform, delivering up-to-date coverage on breaches, emerging threats, malware, vulnerabilities, and global cyber incidents.
Besides, such things as containerization help isolate and separate work data from personal data on employee devices. A good example is GetContact, which was installed on the phones of millions of users, resulting in their data being freely leaked on the internet. In some cases, confidential data that should only be transferred through a secure tunnel may fall into the hands of attackers even before it is sent while still in an unencrypted form on an employee’s device. But are these communication tools secure, reliable, compliant and able to safeguard our data? Recent incidents involving major players like Disney, Zoom, Microsoft Teams, WhatsApp, and Discord highlight the vulnerabilities inherent in these communication tools.
In recent months, there has also been an increase in attempts to hijack WhatsApp accounts using social engineering. Leveraging personal data collected from previous breaches or social media, the attacker impersonates an acquaintance, technical support, or a trusted entity, convincing the victim to provide the verification code received via SMS. Their vulnerabilities are quickly researched and exploited, and Google typically responds with frequent patches.
- This strict validation ensures that even if a user is tricked into clicking a malicious link, unauthorized configuration changes are blocked.
- Security experts recommend that users maintain updated application versions and exercise caution when opening files from unknown sources, while organizations should implement comprehensive security monitoring for instant messaging platforms.
- The system responded to an enormous number of requests from a single source, when the reasonable course of action would have been to reject or limit them.
- SMS and iMessages are commonly used by scammers to send links intended to carry out phishing attacks, and to attempt to instal malware in iPhones.
- Best practice is to only ever use your own bookmarks or type URLs manually, and only do the latter if you have good reason to think the message genuine.
SMS and iMessages are commonly used by scammers to send links intended to carry out phishing attacks, and to attempt to instal malware in iPhones. By carefully measuring electromagnetic signals during the chip’s startup process, they identified the precise moment when firmware validation occurred. A security vulnerability has been discovered in the USB-C port controller fitted to the iPhone 15 and 16. However, exploiting it would be so complex that both Apple and the security researcher who discovered it concluded that it is not a real-world threat.
New Research Reveals Multiple Attack Surfaces In Wechat & Other Instant Messaging Apps
Most programs won’t accept reports about missing origin validation or wildcard targets as standalone vulnerabilities without a proof of concept showing how an attacker could practically abuse them. The security of postMessage implementations relies heavily on proper validation of these properties, particularly event.origin. When developers skip origin validation or improperly handle message data, postMessage vulnerabilities can and will emerge. Before we move to the exploitation part, let’s first understand how we can identify potential postMessage vulnerabilities.
Using Messaging Applications Infographic
WeChat has implemented several security mechanisms to address these vulnerabilities, including multi-process sandboxing that isolates rendering processes from the main application. The security implications extend far beyond individual applications, affecting the broader instant messaging ecosystem that serves as “digital arteries” for modern society. WeChat’s file processing system, designed to enhance user experience through file previews and content extraction, creates significant security exposure when handling untrusted content. The newly identified attack vectors primarily target the file processing capabilities built into instant messaging clients.
While newer versions of Spring Boot have addressed this security concern by disabling public access to such endpoints by default, TeleMessage instances continued using the vulnerable configuration through at least May 5, 2025. Passkeys are the future of authentication, offering enhanced security and convenience over passwords, but widespread adoption faces challenges that the NCSC is working to resolve. Those working in government should follow government guidance on the use of non-corporate communications channels. Messaging apps such as WhatsApp, Messenger and Signal are an important part of how we communicate every day.
Macworld reports that Apple concluded it wasn’t a realistic threat after examining the method used, and Roth agreed. Barclay has been writing about technology for a decade, starting out as a freelancer with ITProPortal covering everything from London’s start-up scene to comparisons of the best cloud storage services. After that, he spent some time as the managing editor of an online outlet focusing on cloud computing, furthering his interest in virtualization, Big Data, and the Internet of Things. Given that Project Zero’s investigation only looked at peer-to-peer calls, an alarming number of vulnerabilities were discovered.
Best Secrets Detection Tools Compared ( : Features & Pricing
Thanks to this weakness, researchers demonstrated that it was possible to query more than 100 million phone numbers per hour through WhatsApp’s infrastructure, ultimately enumerating some 3.500 billion active accounts in 245 countries. The system responded to an enormous number of requests from a single source, when the reasonable course of action would have been to reject or limit them. Chainalysis’ latest crime report notes that over $2.17 billion has been stolen so far in 2025, a pace that would take crypto-related thefts to new highs. Notable security attacks over the past months include physical “wrench attacks” on Bitcoin holders and high-profile incidents such as the February hack of crypto exchange Bybit. As of Wednesday, at least 11 IP addresses have actively tried to exploit the vulnerability, with thousands more addresses possibly doing reconnaissance work. It’s the equivalent of someone demanding access to my iPhone with a gun to my head, which is more likely a thing to happen than someone getting hold of my iPhone, and attempting to do this electromagnetic whatsit.
From massive leaks of internal documents to the exposure of sensitive user information, these breaches serve as a stark reminder that these platforms are not secure. Security experts recommend that users maintain updated application versions and exercise caution when opening files from unknown sources, while organizations should implement comprehensive security monitoring for instant messaging platforms. In this post, we’ll explore the major data breaches that affected messaging apps between 2020 and 2024, analyze what went wrong, and extract lessons to build safer communication platforms — https://instan-talks.com/ without sacrificing convenience. When deciding to develop messaging software, it is crucial to focus not only on its functions but also on its architecture. The program must enable communication via a closed and encrypted channel and should not request any potentially sensitive information, such as a phone number.
The vulnerability stems from TeleMessageTM SGNL’s continued use of legacy Spring Boot Actuator configurations, where a diagnostic /heapdump endpoint remains publicly accessible without authentication. Ryan Naraine is Editor-at-Large at SecurityWeek and host of the popular Security Conversations podcast series. He is a security community engagement expert who has built programs at major global brands, including Intel Corp., Bishop Fox and GReAT. Ryan is a founding-director of the Security Tinkerers non-profit, an advisor to early-stage entrepreneurs, and a regular speaker at security conferences around the world. How high-risk individuals can protect their accounts when using apps such as WhatsApp and Signal. Your browser’s built-in developer tools can also be deployed to trace back postMessage calls.
WeChat mini-programs split execution into a rendering layer (UI) and a logic layer (business logic), each running in isolated threads. This strict validation ensures that even if a user is tricked into clicking a malicious link, unauthorized configuration changes are blocked. Critical remediation steps include disabling or restricting access to the /heapdump endpoint, limiting exposure of all Actuator endpoints unless explicitly required, and upgrading to supported Spring Boot versions with secure defaults. GreyNoise telemetry reveals that 2,009 IP addresses have scanned for Spring Boot Actuator endpoints within the past 90 days. The security firm created a dedicated tracking tag on July 10 to monitor these exploitation attempts.
Users of the app may include former US government officials like Mike Waltz, US Customs and Border Protection and crypto exchange Coinbase. The issue “stems from the platform’s continued use of a legacy confirmation in Spring Boot Actuator, where a diagnostic /heapdump endpoint is publicly accessible without authentication,” the research team told Cointelegraph. As ChatGPT and other AI systems become more prevalent, phishing attacks utilizing messengers and other communication channels are becoming more advanced.
From smishing (SMS phishing) to interception of authentication codes, location tracking, and SMS flooding attacks, the humble text message has become a prime vector for telecom fraud and surveillance. Even in 2025, SMS-based attacks remain one of the easiest ways for adversaries to exploit signaling vulnerabilities in SS7, SIGTRAN, Diameter, and LTE networks. On an individual level, there are several guidelines anyone can follow to reduce their exposure when using messaging apps. The first is to treat phone numbers and codes received via SMS as sensitive credentials that should never be shared , even if the person requesting them appears to be a friend, a technician, or the app itself. Throughout this article, we will calmly but frankly examine why these tools are not harmless, what real risks they pose, and what alternatives and best practices exist to minimize the potential for disaster. The discovery, made by cybersecurity firm iVerify, reveals how attackers could compromise iPhones without any user interaction by exploiting a flaw in iMessage’s contact profile update feature.
