WeChat bug could hijack accounts via calls

Accounts were compromised by serious error A serious security flaw in WeChat made it possible to take over users' accounts through an incoming call without the victim answering. The security company Calif has discovered a vulnerability in the messaging app WeChat that allowed users' accounts on both iPhone and Android to be taken over. The attack worked through a regular incoming voice call and required no action from the caller. The vulnerability was discovered by researchers at Calif, who built a testing tool called WeWorm. In their demonstration, an attacker was able to take over a WeChat account while the phone was still ringing. It didn't matter if the user answered or let the call continue to ring. The researchers showed how the attack could spread from one phone to another. In the test, an Android phone called an iPhone and took over its WeChat account. The hijacked account was then used to call another Android phone and carry out the same attack. For the attack to work, the attacker had to already be in the victim's contact list on WeChat. The researchers still believe that this is not a strong protection, since a hijacked account can be used to attack the person's contacts and thus spread further. An attacker who succeeded in the attack gained control of the victim's WeChat account. It made it possible to read and send messages, make calls and act as the account owner. However, the vulnerability did not give direct control over the entire phone. According to Calif, the flaw was found in WeChat's internet calling system, so-called VoIP technology. The researchers also state that artificial intelligence helped them both find the vulnerability and develop the first working attack code in a short time. The vulnerability was reported to Tencent, which owns WeChat, in July. The company has since implemented protections that the researchers say block the attack for all users. There are no known cases where the flaw has been exploited against real users. With over 1.4 billion users worldwide, the discovery shows how far-reaching the consequences of an error in a popular messaging service can be. At the same time, both the researchers and Tencent say that the described attack method has now been stopped. Related articles tencent ios android wechat