The recent breach of Assistant Attorney General Savvas Angelidis’s WhatsApp account brings the issue of personal data security and the risks associated with using popular apps back into the spotlight. The incident raises legitimate questions about just how vulnerable users ultimately are to such attacks and what they can do to protect their personal data.
Speaking to Alphanews.Live, cybersecurity expert Dinos Pastos made it clear that these types of attacks do not discriminate based on a person’s profession or status, explaining that anyone who uses such apps can fall victim.
ΣΧΕΤΙΚΑ ΑΡΘΡΑ
READ ALSO: Angelidis, a Victim of Hackers: How They Gained Access to His WhatsApp for Hours and What an Investigation by Alexis Mavros Revealed | AlphaNews
As he noted, these attacks are often carried out on a massive scale, with the perpetrators attempting to deceive as many users as possible.
“The victim doesn’t need any special technical knowledge for this to happen. All it takes is a moment of inattention or a misleading instruction.”
When asked how someone could gain access to our personal messages and calls through apps like WhatsApp, Mr. Pastos explained that, in this specific case, it is not a breach of the WhatsApp app itself or its systems, but rather a method of deceiving the user.
As he noted, WhatsApp has a feature that allows users to link their account to a second device, such as a computer or another cell phone. Scammers exploit this feature and, using deceptive messages, links, or QR codes, try to convince users to authorize the connection of an unfamiliar device, believing they are doing something entirely different.
“Once the connection is approved, the attacker can gain access to the synced chats and send messages on behalf of the victim, without the victim necessarily losing access to their own account,” he adds.
When asked how secure apps like WhatsApp ultimately are, Mr. Pastos clarified that WhatsApp is a fairly secure app when it comes to protecting the content of our communications. He explained that it uses end-to-end encryption, which means that messages and calls are protected so that they cannot be read or monitored by third parties while in transit.
However, it emphasizes that no app can completely protect a user who is tricked into granting access to their own account.
As he points out, in this particular attack method, the encryption itself is not compromised. The attacker manages to make their own device appear as the user’s authorized device.
Therefore, “we must distinguish between the security of the app and the security of our account.”
Regarding how we can tell if someone has gained access to our account, Mr. Pastos stated that some apps have notification mechanisms that alert you when a new device is logged into your account, and a message may also appear indicating that chats are being synced. As he explained, users can check the app settings to see which other devices have access to their account.
“If we spot a device we don’t recognize, we should disconnect it immediately and check our security settings.”
Mr. Pastos also pointed out that indicators and notifications may vary depending on the app and are not always available in the same way.
Finally, he emphasized that unauthorized access to our conversations isn’t necessarily accompanied by obvious changes or malfunctions on our phones. Consequently, someone could gain access to our conversations without us noticing anything unusual in how our device operates.
Referring to the measures citizens can take to protect their personal data, he emphasized the need for increased caution when using apps and online services. He noted that special care is needed when opening links and visiting websites, but especially when granting permissions and authorizations to apps and services.
At the same time, he emphasized that users should not approve actions they do not fully understand, nor should they share verification codes they receive on their cell phones, even when asked by people who seem familiar or trustworthy.
In addition, he advised enabling two-factor authentication wherever available and regularly checking the devices connected to their accounts.
In conclusion, Mr. Pastos emphasized that “many modern cyberattacks do not attempt to bypass security technology, but rather to deceive the people who use it.”
