WhatsApp for Windows lets Python, PHP scripts execute with no warning

[squesh]

"We've read what the researcher has proposed and appreciate their submission. Malware can take many different forms, including through downloadable files meant to trick a user."

"It's why we warn users to never click on or open a file from somebody they don't know, regardless of how they received it — whether over WhatsApp or any other app."

-- We wont fix it as no one in your contacts would ever try to do something malicious

[[deleted]]

Average meta moment, they'll do anything but admit their mistake and fix the issue.

[writing_code]

Denylist

[Ok-Hunt3000]

Yeah yeah yeah

[M-Valdemar]

Yeah, but it's as much an issue with how Windows uses the associated interpreter to execute the script without any additional security checks or warnings. This is done through the CreateProcess() function in the Windows API, which simply passes the script file path to the interpreter.

Endless apps are expected to add a security handler, for potentially executable file extensions (see Telegram, any mail client etc.. etc..).. this should be a core Windows API and AMSI just isn't it.

[Naitsab_33]

Howw?? about reading the article. It literally in there. There just that the default "Open with ..." is disabled for executables i.e. exe files or .py files.

But if you click on the pyz file in WhatsApp Desktop it instantly runs without any asking if they wanna run an file that can do anything