The simple security of WhatsApp Security Facicish has been exposed to 3.5 million phone numbers
Whatsapp discovery We have parts in the section on how easy it is to find a new contact on the messaging platform: Enter the phone number of the other person, and WhatsApp immediately shows if they are in service, and again.
Repeat that same ability of a billion and all phone numbers, it turns out, and the same feature can also work as an easy way to find a whatsapp user of the whole world, in many cases, profile pictures and text that identify each of those users. The result is an expression from the personal knowledge of a significant portion of the world’s population.
Another group of Austrian researchers has now shown that they were able to use that simple method of looking up all the numbers found in getting the phone numbers of whatsapp users to extract the numbers of the messages. 57 percent of those users, also found that they can access their profile pictures, and another 29 percent, the text on their profiles. Despite a previous warning about WhatsApp’s disclosure of this data from a different researcher in 2017, they say, the service’s parent company, meta, still failed to look at nearly 100 numbers per hour.
The result would be “the largest data leak in history, it wouldn’t have been called as part of a feasibility study,” as the researchers explained in a paper documenting their findings.
“To the best of our knowledge, this marks the most extensive exposure of phone numbers and associated user data recorded,” said Aljosha Dhristiyer, one of the researchers at the University of VIENNA who worked.
The investigators said they alerted Meta about their findings in April and removed their copy of 3.5 billion phone numbers. In October, the company had fixed the measurement problem by adding a “scale limitation” measure that blocks the way to get information about the large scale that researchers are working on. But until then, the presentation of the data is likely to be supported by someone else using the same grazing process, adds Max Günther, another university researcher who compiled the paper. He says: “If the US can get this very easily, others have done the same.
In a statement to the wire, Meta thanked the researchers, who reported their discovery through its “Bug Bounty” program, and described the information revealed as “basic information available,” because profile pictures are not displayed by users who choose to keep them private. “We are already working on industry-leading systems, and this research has resulted in stress testing and ensuring the immediate effectiveness of these new safeguards,” wrote Nitin Gupta, Deputy Mongamenkuva of Mbuyelisha at Whatsapp. Gupta adds, “We found no evidence of malicious actors abusing this vector. As a reminder, user messages remain private and secure WhatsApp generated data, and no private data is available to investigators.”
