Researcher: WhatsApp database on Android devices can be stolen
A researcher has highlighted a potential privacy issue in the Android version of the messaging service WhatsApp. In a blog post earlier this week, Bas Bosschert, a consultant and CTO of startup Doublethink detailed a proof and concept in which he was able to access and decrypt the WhatsApp database containing archived chat messages.
The heart of the issue is related to how the Android version of WhatsApp stores its database on the SD card, essentially accessible by any other Android apps that are granted the right to access the flash memory card. According to Bosschert, this is an issue with Android's data sandboxing system, which allows for data to be stored in a centralized storage location.
What it means is that a malicious app could conceivably steal the WhatsApp database and upload it to a remote location. Bosschert has since posted a new blog post that shows how this can be done.
The new version was published very shortly after the first blog went viral, and drops the original static encryption key in favor of a dynamic one generated using the account name. This is more robust, though it is understood that hackers have already put together a Python script that is able to decrypt it as well.