Facebook advised to give WhatsApp a security review
WhatsApp, the mobile messaging service Facebook just bought for US$19 billion, has several security weaknesses that experts say are worth addressing.
None of the flaws found this week by app security vendor Praetorian are critical. Instead, they represent lapses in best practices for securing mobile apps.
“For the most part, these are not high-risk flaws,” says Andrew Hoog, chief executive of mobile security vendor viaForensics. The weaknesses, which are common in many mobile apps, include not enforcing SSL (Secure Sockets Layer) pinning when WhatsApp establishes the connection between the mobile phone and the company’s backend server. SSL pinning involves having the client check the server’s certificate against trusted validation data.
