Whatsapp blamed own users for failure to keep phone number repo off Google searches
- Reference: 1591995724
- News link: https://www.theregister.co.uk/2020/06/12/whatsapp_google_search_results_blunder/
- Source link:
Athul Jayaram, a self-described “full time bug bounty hunter”, published a blog post earlier this week highlighting that a large number of Whatsapp users’ mobile numbers could easily be found by searching Google for the domain “wa.me”.
That domain formed part of Whatsapp’s Click to Chat function. If you, the owner of a Whatsapp account, fancied letting world+dog add you as a new chat contact rather than going through the tedious process of tapping their phone number into yours, digit by digit, you could generate a QR code (yes, one of those things…) for them to do so.
Billed as a feature for businesses wanting to make customer comms easier, Click to Chat QR shortcodes resolved to https://wa.me along with a unique URL string. The unique string just happened to be the full phone number of the user.
“This feature does not encrypt the phone number in the link, as a result, if this link is shared anywhere, your phone number is also visible in plaintext,” said Jayaram in his [1]blog post .
He went on to do some Googling, using the “site:” operator to restrict his searches to the Whatsapp QR code domain, finding what he estimated was around 300,000 phone numbers from a variety of countries including India, America and Great Britain.
It's 2019 and a WhatsApp call can hack a phone: Zero-day exploit infects mobes with spyware [2]READ MORE
Clearly the right thing to do would have been for Whatsapp to simply set wa.me’s robots.txt file so Google didn’t index the site, something that also occurred to Jayaram. Yet it decided to blame its own users for its privacy screwup, [3]telling Techcrunch that Jayaram’s findings “merely contained a search engine index of URLs that WhatsApp users chose to make public.” A spokesman added to the site: “All WhatsApp users, including businesses, can block unwanted messages with the tap of a button.”
Although Jayaram seemed annoyed that he didn’t earn a bug bounty payout, that isn’t the issue here. Whatsapp has suffered from security and privacy problems in the recent past – [4]some big , some [5]less so , and some [6]downright scary . Facebook, its owner, makes a big deal out of its security features including end-to-end encryption. Technical security is no good if you’re going to let the world’s biggest search engine, run by the world’s biggest advertising technology company, hoover up your users’ phone numbers by exposing them in plaintext on one of your websites.
Although wa.me has since been cleansed from Google, now the whole world and its malicious dog knows where to go to find a nice big repository of active phone numbers for [7]smishing , [8]SIM swapping and all the other ways in which bad people can steal personal and/or financial data starting with an active mobile phone number. Bad people don’t respect robots.txt, after all.
We have asked Facebook for comment and will update this article if the company replies. ®
Sponsored: [9]Free Hands-on Training: Anthos Service Mesh
[1] https://medium.com/@athuljayaram/your-whatsapp-number-may-be-leaked-in-the-open-web-they-dont-care-do-you-dcf147236746
[2] https://www.theregister.com/2019/05/14/whatsapp_zero_day/
[3] https://techcrunch.com/2020/06/09/whatsapp-resolves-issue-that-exposed-some-users-phone-numbers-in-google-search-results/
[4] https://www.theregister.com/2020/02/05/whatsapp_xss_bug/
[5] https://www.theregister.com/2019/12/17/whatsapp_group_chat_wipe_vulnerability/
[6] https://www.theregister.com/2019/05/14/whatsapp_zero_day/
[7] https://www.theregister.com/2016/09/15/mobile_chat_spam_simply_smishing/
[8] https://www.theregister.com/2019/03/09/security_roundup_080319/
[9] https://go.theregister.com/tl/1956/-9050/free-hands-on-training-anthos-service-mesh?td=wptl1956
Re: It's an unknown
"Is there any good reason"
Yes. Some years ago I ended up spending over £100 in txt messages as I'd gone over my limit. Then a few years later I'd reach my limit so had to wait for the new month. Then I finally forced myself to sort out my old shitty contract.
Anyway. I then discovered WhatsApp and realised I could essentially send txt messages and picture messages for free.
Re: It's an unknown
" I could essentially send txt messages and picture messages for free. "
So can I. From my phone. Standard part of the contract. No third party data guzzle service required.
Re: It's an unknown
A LOT of (UK) contracts exclude MMS in your call plans. For example, I just checked and 3 charges 55p each, Giff Gaff 30ppm
Add to that, many emojis can get changed to MMS, it can add up.
Re: It's an unknown
My kids have €6 contracts which includes 4GB data (no speed cap), but phone calls and txt messages cost extra. The monthly bills are typically €6 apiece since they mostly call and text their friends and family via Whatsapp using (home) wifi and most often don't exceed the pooled data allowance. (i.e. they have 8GB to burn together).
Still has an issue
With profile or being discovered is on by default and you have to specially go in and set yourself to private or allow only your contacts to add you.
Which means I still have old friends I no longer see in my phone book with their old number. That number that now belongs to someone else who hasn't hidden their profile. So I can now see "Sally" appears to now be "Dave".
Re: Still has an issue
JK Rowling is not impressed...
‘hoover up your users’ phone numbers’
Vacuum you mean
Vacuum?
Just because their security leaves you breathless, that doesn't mean there is an absence of air.
Pro tip: If you accidentally hoover up your phone number put on a dust mask and google in the bag for it.
Bug
How the hell can they blame their users for choosing to make their phone numbers public.
They are the ones to make it public by putting the unencrypted phone numbers on the web. But hey to make it easier they even make them visible to search engines.
They add a new feature for people to use and then blame their users for using that feature.
They are the ones to blame for designing (I use the term lightly) and then coding a piece of software without once ever thinking about security from beginning to end.
To make it worse they do not even see it as a bug and refuse to pay a bug bounty. I can see why. Athul Jayaram did not find a bug in the feature, because the whole bloody feature is just one giant bug.
Re: Bug
The response from What Saps is typical of the Zuck Empire, nothing is ever their fault, they are just doing their best (to make money from your data).
Re: Bug
It's not a bug, it's working exactly as intended.
I don't use WhatsApp because it's owned by Facebook
Mark Zuckerberg is a certified cunt so I'm afraid you're really not paying attention and deserve what awaits if you decide to use any of his company's products.
How soon until the first GDPR complaint?
FB and GDPR
See https://noyb.eu/en/open-letter to understand that FB just ignores GDPR, with help from Ireland.
It's an unknown
Is there any good reason, besides the equivalent of waving your hands above your head and yelling "Look at me! I'm so important!", to actually choose to use any of these social media constructs? Every single one violates your privacy by digging deeper into your personal life than you really expect them to. Every single one has security issues. Every single one tries to entice you deeper into their plot of 'connecting everyone!', that being world domination for their exclusive benefit.
Every single one is a money-making sham, and you're the sucker.