A critical alert has been released for WhatsApp users following the discovery of a significant security flaw by cybersecurity professionals....
A critical alert has been released for WhatsApp users following the discovery of a significant security flaw by cybersecurity professionals.
Experts claim that a basic vulnerability enabled them to gain access to 3.5 billion profiles on the Meta-owned messaging platform.
Even though users' messages stayed encrypted, the researchers claim they managed to collect large amounts of 'metadata'.
This enabled them to uncover private details, such as phone numbers, location, device type, and the age of an account.
Researchers from the University of Vienna and SBA Research claim that a vulnerability enabled them to manipulate WhatsApp's internal contact identification system.
Typically, this allows the application to access a user's directory of contacts in order to locate other WhatsApp users through their phone numbers.
Nevertheless, the researchers discovered that there was no restriction on the number of contacts this system could look for.
By taking advantage of this vulnerability, the researchers managed to scan 100 million phone numbers each hour and gain access to billions of user accounts.
Primary author Gabriel Gegenhuber, a scientist from the University of Vienna, states: 'Typically, a system shouldn't react to such a large volume of requests within such a brief period - especially when they come from one single source.'
This conduct revealed the fundamental weakness, enabling us to send an essentially limitless number of requests to the server and, as a result, map user information across the globe.
With this method, the researchers uncovered a remarkable collection of data from WhatsApp accounts across 245 countries.
Collaborating with the researchers, Meta states that it has now 'resolved and lessened the problem'.
Nitin Gupta, the Vice President of Engineering at WhatsApp, states: 'We were already developing advanced anti-scraping technologies, and this research played a key role in testing and verifying the effectiveness of these new protections right away.'
Notably, the researchers have permanently erased the data gathered during the study, and we have not identified any signs of unauthorized individuals exploiting this method.
Mr. Gupta also emphasizes that users' messages are kept safe and confidential, and thatWhatsApp's end-to-end encryptionwas never compromised at any time.
Nevertheless, the researchers claim their study highlights the danger of concentrating global communication through only a handful of applications.
The publicly accessible data that researchers first had access to was merely the type of information that any individual with a user's phone number could view.
Nevertheless, they were also capable of obtaining extra details, enabling them to identify a user's operating system, account duration, and the quantity of connected companion devices.
In nations such as the United States, Brazil, and Mexico, there was sufficient information to determine a user's location up to the state level.
This might result in a user receiving fraudulent calls or facing other forms of attack.
Co-author Dr. Aljosha Judmayer states: "End-to-end encryption safeguards the content of messages, but may not always protect the related metadata."
Our research demonstrates that privacy issues may also emerge when this metadata is gathered and examined on a significant level.
By utilizing the data gathered through showcasing the vulnerability, the researchers managed to uncover some unexpected information regarding WhatsApp's worldwide user base.
For instance, the scientists found that thereare there millions of active WhatsApp accounts in nations where the service is officially prohibited.
These include China, Iran, and Myanmar, all of which have stringentrestricted entry to worldwide online services.
More alarmingly, the researchers found that fifty percent ofThe 500 million phone numbers leaked in the 2021 Facebook incidentwere still using WhatsApp.
The breach revealed the complete names, phone numbers, addresses, and birth dates of users on the platform from 2018 to 2019, which were shared on a hacking forum.
The Irish Data Protection Commission imposed a fine of €265 million (£233 million) on Meta, the parent company of Facebook, following a decision that the breach led to the company's failure to comply with data protection regulations.
The scientists mention that individuals using a number that was previously revealed in this breach face ongoing and increased cybersecurity dangers.
Read more- Is your WhatsApp a gateway for hackers? Discover the alarming zero-click vulnerability endangering your privacy!
- What caused a harmless quiz application to expose 311,000 Australian Facebook accounts?
- Is Facebook potentially compromising user privacy by adding AI capabilities to WhatsApp, even though it asserts secure data handling?
- Could your personal information be in danger due to the 'mother of all breaches,' which revealed 16 billion records from companies like Apple, Google, and Facebook?
- Are you at risk from the newest WhatsApp security issue? Discover how to protect your privacy by applying the crucial update immediately!
