Get the latest tech news
I found a 1-click exploit in South Korea's biggest mobile chat app
Stealing another KakaoTalk user’s chat messages with a simple 1-click exploit.
In this blog post we show how multiple low-hanging fruit vulnerabilities in KakaoTalk’s Android app can lead to the disclosure of users’ messages. A deep link validation issue in KakaoTalk 10.4.3 allows a remote adversary to run arbitrary JavaScript in a WebView that leaks an access token in a HTTP request header. The goal of the PoC is to register KakaoTalk for Windows/MacOS or the open-source client KiwiTalk to a victim’s account to read her/his non-end-to-end encrypted chat messages.
Or read this on Hacker News
