Are Your Messages Safe?

Most of us use messaging services in order to keep in contact with others. We might simply send details of meetings in a quick message, or we could share important documents in this way. Messaging is a quick and easy way to get in contact with someone. There’s no fuss. You just type what you want to say, attach the files you want to give to them, and hit send.

However, while it is quick and simple to do, it might not be as secure as you were hoping for. Most people don’t think too much about it. You hit send and the person you are messaging gets it, right? But with all the hacks and leaks lately, more and more people have been thinking about messaging services and just how secure they are.

So just how secure is it when you use a messaging app? It is simply a case of clicking send and forgetting about it, or do we all need to be a little more cautious about it?

Malicious websites

For some messaging apps, all the hackers and attackers have to do is get the victim to click on a link. It might not seem like much, but these links lead to malicious websites. The websites then give the hackers a way to see all of the private message conversations the victim has had. Yes, this does include messages sent from the web browser applications and mobile apps.

Receiving a suspicious looking link might not seem like a big deal to most people. You will look at the link and think “something about this is off”. You might then go online to do a little research into the link and find out if it is, as you suspect, malicious.

However, when the link comes from somebody that you trust, it is easy to just click it without thinking. And this is where the problems occur. The instant you click the link, the attackers have access to your conversations.

So how does it work? According to the security researcher at BugSec and Cynet, it is a cross-origin bypass-attack that gives people access. It was discovered at the end of last year and seems to focus purely on Facebook Messenger.

A lot of people don’t feel totally comfortable sending things through Facebook anyway. It is a social media site and, with all the hacks lately, the idea of sending private things on this site makes people feel uncomfortable. And so people will instead use things that they believe are more secure… such as WhatsApp.

Exploiting the backdoor

WhatsApp is considered by many users to be secure. It runs on an end-to-end encrypted messaging service, which many consider to be the ultimate protection. It keeps people from snooping at your private messages. The problem with it is that, if it isn’t implemented correctly, your messages can still be intercepted.

WhatsApp is the largest secure messaging platform in the world, so you’d think that it has end-to-end encryption down, right? Unfortunately, like many messaging apps, there is a backdoor that can be exploited.

Sometimes WhatsApp will automatically exchange new keys for users in order to help you continue to send messages quickly. When it does this, you might not be alert to the fact that the key has changed. In fact, you will only know about this if you manually turn “security notifications” on. And because of this exchange, hackers can get in.

Hackers can simply replace the public key for one user with their own. This means that any undelivered messages will then be redirected to the hacker, who can then read the messages because of the key that they have used.

You might think that this isn’t such a big deal as the app will be updated soon to fix it… but it hasn’t. As of now, the backdoor still exists, and so anything you send through the messaging app is vulnerable. Definitely not what you want, especially if you are sending important documents!

How can you check if your messages are secure?

There are a few different questions you can ask yourself in order to see how secure the messages you send will be, depending on the method you send them. For a start, most of the messages that you send through apps will be encrypted in transit. However if it is encrypted, does the messaging provider have access to the key to decrypt your communication?

While on the subject of security keys… what if your keys are stolen? Can anyone with those security keys then access your past communications, or are they locked and unable to be accessed again?

If you really want to stay secure then it is also a good idea to see just how well the security of the app is. Has it been well-documented so that you can do your own research into it? If so and you like the look of the information there, then you might be on to a winner.

Further authentication

One of the best ways to keep your messages secure when you are using different messaging apps and websites is to have another layer or authentication or security in place. Don’t simply rely on the app to do the work for you, as this can land you in trouble.

For example, WhatsApp now offers a third security layer. Using a QR code or a 60-digit number, you can then verify the keys of those you are communicating with to ensure it is genuine. However, remembering a 60-digit number if doing to be tough. You might right it down somewhere. Using a QR code also means a physical copy. And this, yet again, shows another vulnerability.

However it is a good solution, and if you use other forms of authentication it can really do a lot to help put you at ease that your messages are secure. You could also take the time to investigate and research more secure alternatives.

The important thing to keep in mind is that your messages might not be secure. If you aren’t sure, you need to take steps to protect your messages from potential hacks and backdoors built into the apps.

• About
• Latest Posts

Hayley Kershaw

With experience working with technology, and as an avid fan of industry, Hayley understands how important security is. While keeping up-to-date with technology, she also enjoys learning about the latest trends in cybersecurity and data protection, as well as the most recent methods for staying safe online. These techniques are shown in the ODS blogs she writes, where she aims to teach others without experience in data protection the important of cyber-awareness and cybersecurity in order to educate and inform.

Latest posts by Hayley Kershaw (see all)

• Why you need to train your CEO before your employees - September 14, 2017
• Your computer may be a zombie! - July 25, 2017
• All You Need To Know About GDPR - July 4, 2017