The developers of the popular WhatsApp messenger have announced the introduction of several new security features, the most important of which is “Device Verification”. This feature is designed to protect users from account takeover attacks, which are usually carried out using authentication keys stolen from infected mobile devices or obtained through unofficial clients. Device Verification works by automatically blocking any account takeover attempts through a series of background checks using three new parameters: a security token stored on the device; a nonce used to identify the client connection to receive messages from the WhatsApp servers; and authentication requests that will asynchronously ping the user’s device. Additionally, WhatsApp has also announced two more security features: Account Protect, which notifies users when their accounts are transferred to other devices, and Automatic Security Codes, which automatically check security codes to confirm a secure connection to the server. These features are currently being rolled out to WhatsApp for Android and iOS users around the world.
