Israeli Firm Wintego Introduces CatchApp with ‘Unprecedented Capability’ to steal WhatsApp’s Encrypted Communications — But experts are not buying it.
Israeli spy tech firm Wintego has claimed to develop a remarkable new app that is equipped with extensive surveillance capabilities. The most interesting part is that it can capture content from WhatsApp by bypassing its encryption code. The new app is called CatchApp and it can siphon off encrypted communications made through WhatsApp on mobile phones. But the catch is that this app can only steal data from a phone that is present in close proximity of a Wi-Fi hacking device hidden in a backpack.
The Haifa-based spy tech firm is claiming that this new app has “unprecedented capability” to steal everything from a phone’s WhatsApp database via a man-in-the-middle attack. The app firstly intercepts the traffic passing between the app and the server of WhatsApp and then the device decodes the encryption.
Must Read: This is how hacked Israeli drone feeds look like
However, Wintego maintains that their app can catch content on most of the current versions of WhatsApp. No evidence was provided by the company to prove this claim, though. At least not for now.
The CatchApp is transferred to the phone through WINT product of Wintego. WINT is a hacking device that has to be fitted into a backpack. In fact, the company claims that WINT is their very own “data extraction solution,” because it can steal all the content of the target’s “email accounts, chat sessions, social network profiles, detailed contact lists, year-by-year calendars, files, photos, web browsing activity, and more.” The app manages to do so by obtaining login credentials for different accounts and whatever data is stored in it is extracted and discreetly downloaded.
Through WINT, Wintego states that it is possible to overcome the encryption and security measures of various apps and web accounts to obtain credentials. On the other hand, on apps where login credentials aren’t required such as WhatsApp, Facebook Messenger and Telegram, etc., WINT Cyber Data Extractor can simply steal “secured data right from the apps.”
WINT performs its operations by gaining access to a target device by intercepting Wi-Fi communications regardless if these are on private encrypted networks or public. Four separate Wi-Fi access points are used to track devices and high gain antennas. This device is so tiny that it can easily be fitted into a backpack.
However, security experts are not buying the claims made by Wintego as they are not convinced that WINT kit is so powerful since these techniques can hardly affect WhatsApp’s encryption measures. Jonathan Zdziarski believes that CatchApp probably exploits the Secure Sockets Layer (SSL) encryption.
Zdziarski told Forbes that:
“I suspect they’re taking advantage of a number of vulnerabilities in SSL implementations… many systems are susceptible to downgrade attacks and other types of MITMs.”
Or, it is also possible that CatchApp is actually a malware that has been installed onto a device over WiFi networks the specific targets of which is WhatsApp. Whatever it is, security gurus are certain that this app cannot break into WhatsApp’s encrypted chats and messages. However, if the firm comes up with real life demo things can be otherwise.
The IT security researcher Ben Brown from 31337 IT Solutions commented on Wintego claims and said that these are just wild claims.
Related: 8 Technologies That Can Hack Into Your Offline Computer and Phone
“I would say the Israeli security firm is using false advertising and science fiction to promote a product that doesn’t work even WhatsApp says so.”
A few months ago another Israeli company “Ability” developed a software and claimed that it can trace calls, texts and location of every single mobile phone on earth.
Forbes
Wintego
