InfoSecBulletin Cybersecurity for mankind
Meta’s WhatsApp is now silently fixing security issues that could reveal users’ operating system details to attackers. Privacy issues impact over 3 billion users, allowing attackers to gather information before launching malware attacks.
Understanding the Fingerprinting Threat:
EDIC Propose to invest $2 billion in an AI data center in Bangladesh
NVIDIA BlueField Flaw Enables Code Execution Attacks
Massive customer data from India’s Bank of Baroda surfaced online
Active Exploits Hit Fortinet, Arista: AI Discovered Linux Kernel Zero-Day
Sam Altman Claims AI “singularity” has arrived, Where Systems Improve by Themselves
Shinyhunters claimed and set deadline to publish E&Y data
Microsoft, NVIDIA and CrowdStrike Initiate Alliance for Open-Source AI Security
Google Search Results Reportedly Show Claude AI Shared Chats
“PentesterFlow” AI Automation Tool for Penetration Testers and Bug Hunters
Jailbreak works against AI Models GPT-5.6, Claude Opus 5, and Fable, Claims Researcher
Security researchers found that WhatsApp’s end-to-end encryption for multiple devices unintentionally exposes device metadata. Each device has its own encryption session with a unique key, allowing for easy identification.
Bad actors can leverage and use WhatsApp as an attack vector for the query WhatsApp servers for encryption material and extract device-specific information without any user interaction. This reconnaissance capability poses significant risks to users worldwide.
Recent research shows that ID generation differences enable attackers to identify victims’ operating systems, distinguishing between Android and iPhone. This identification capability is crucial for advanced persistent threat (APT) actors deploying platform-specific zero-day exploits.
Sending an Android exploit to an iPhone would not only fail but also potentially alert victims and compromise sophisticated attack infrastructure worth millions of dollars.
Accurate device identification is crucial for threat actors to maintain operational security before attacks.
Security analysts found changes in how Android generates Signed PK IDs using proprietary research tools. The parameter now creates a random value each month instead of starting at zero and increasing, making device identification harder.
The One-Time PK ID parameter is still flawed. iPhone initialization values vary greatly from Android’s 24-bit random range, allowing precise device identification.
This partial remediation represents progress but leaves critical gaps in protection.
WhatsApp fixed the issue without informing the original reporters or assigning CVE identifiers. WhatsApp issued a bug bounty in one case but didn’t assign a CVE due to low severity.
Security experts believe CVE documentation is crucial for communication in the security community, not just a way to label issues, and that severity is accurately represented in CVSS scores.
Researcher advised that Meta should focus on thorough fixes and notify researchers and assign CVEs to show commitment to security transparency.
