WhatsApp easily exposed 3.5 billion people’s phone numbers | Infinium-tech
WhatsApp is huge, and its growth was driven by how easy it is to find people who use the service – all you need is their phone number. Unfortunately, this also means that every WhatsApp user’s phone number was, until recently, easily obtained by anyone – including any nefarious hacker group.
This has been revealed by Austrian researchers, who were able to extract the phone numbers of all 3.5 billion WhatsApp users. And for about 57% of those 3.5 billion users, researchers were able to access their profile photos, and for another 29%, the text on their profiles.
If you’re wondering what black hat hacking magic trick they need to use, well, none. They just basically tried to add billions of numbers together – the same way you would go about it. You add a number and then WhatsApp tells you whether the person using that number has an account, and shows you their profile picture and account text.
That’s just what these researchers did, only on a larger scale, using the browser-based interface of WhatsApp Web, the service. They were able to check about 100 million phone numbers per hour earlier this year, because despite WhatsApp parent Meta being warned about the issue by another researcher in 2017, it failed to do anything about it.
Thankfully, Austrian researchers reported the problem in April and by October, the company implemented rate-limiting to prevent such mass contact tracing. But of course, it was not implemented for many, many years, during which time all kinds of nefarious actors could exploit the system.
For its part, Meta stressed that all this data is “basic publicly available information” and that profile photos and text were not displayed to users who chose to make it private. The company also reassures everyone that it found “no evidence of malicious actors abusing this vector”, and “no non-public data was accessible to researchers”.
Leave a Reply