WhatsApp Security Flaw Exposed 3.5 Billion Phone Numbers
WhatsApp’s effortless contact discovery—the feature that lets anyone plug in a phone number and instantly see if it belongs to a user—has long been touted as part of its appeal. But, Wired.com reports, the same mechanism that makes onboarding simple also created an enormous privacy gap: cycling through every possible number worldwide allowed researchers to gather the phone numbers of nearly every WhatsApp user on the planet, along with profile photos and public text for many of them.
A team from Austria demonstrated that by repeatedly querying WhatsApp’s contact system through the web interface, they were able to retrieve 3.5 billion phone numbers tied to WhatsApp accounts. For 57 percent of those numbers, the researchers could also view profile photos; for 29 percent, they could read public “about” text. They accomplished this because Meta had imposed no practical limit on how many lookups they could perform, allowing them to sweep through roughly 100 million numbers per hour.
The scale of the exposure stunned the researchers, who wrote that the trove of information would have constituted “the largest data leak in history, had it not been collated as part of a responsibly conducted research study.” One of the authors, Aljosha Judmayer, noted, “To the best of our knowledge, this marks the most extensive exposure of phone numbers and related user data ever documented.”
Meta was notified in April, and the researchers deleted all 3.5 billion numbers they had collected. By October, WhatsApp had implemented new rate limits to prevent such mass scraping from recurring. But until the fix was put in place, the researchers warn, anyone else could have performed the same type of data sweep. As Max Günther put it, “If this could be retrieved by us super easily, others could have also done the same.”
In a statement to WIRED, Meta thanked the researchers and emphasized that users who had set their privacy options to restrict their profiles remained protected. “We had already been working on industry-leading anti-scraping systems, and this study was instrumental in stress-testing and confirming the immediate efficacy of these new defenses,” wrote WhatsApp engineering vice president Nitin Gupta. He added, “We have found no evidence of malicious actors abusing this vector. As a reminder, user messages remained private and secure thanks to WhatsApp’s default end-to-end encryption, and no non-public data was accessible to the researchers.”
The researchers, however, say that they never encountered the “defenses” Meta referenced—pointing out that this isn’t the first time WhatsApp has been warned. In 2017, Dutch researcher Loran Kloeze demonstrated that the same enumeration technique could reveal numbers, profile pictures, and online status. At the time, Meta (then Facebook) argued the platform was functioning as designed and told him he did not qualify for a bug bounty.
Asked by WIRED what protections were implemented in the years that followed, Meta asserted that evolving measures—including rate-limiting and machine-learning systems to detect scrapers—had been deployed. Yet the University of Vienna researchers not only reproduced Kloeze’s discovery, they expanded it dramatically by enumerating all 3.5 billion global accounts. They also analyzed how many users publicly exposed personal information, with 44 percent of the 137 million identifiable American numbers showing profile photos and 33 percent including visible “about” text.
In countries where WhatsApp permeates daily life, even higher percentages left profile photos open. The researchers collected nearly 750 million Indian numbers, 62 percent with photos visible, and 206 million Brazilian numbers, 61 percent displaying profile images publicly.
Their discovery came accidentally last year when they were studying other aspects of WhatsApp’s metadata. They noticed the absence of rate limits and tried enumerating US phone numbers. Within 30 minutes, they had gathered 30 million. “So we were kind of surprised. And then we just kept going,” recalls researcher Gabriel Gegenhuber.
Such a dataset would be invaluable to spammers, scammers, and criminal operations. But the implications extend beyond nuisance calls. The researchers identified millions of WhatsApp accounts registered in countries where the platform is banned—2.3 million numbers in China and 1.6 million in Myanmar. Governments hostile to WhatsApp could have used the same enumeration technique to identify and potentially target citizens using the app illegally. Reports have suggested that in China, some Muslims have been detained simply for having WhatsApp installed.
The Vienna team also examined the cryptographic keys associated with each account—keys used in WhatsApp’s end-to-end encryption. They found an unexpected problem: many accounts shared identical keys. In some cases, hundreds of users were tied to the same key, and 20 US numbers even had an all-zero encryption key. The researchers suspect that these anomalies point to unauthorized or modified WhatsApp clients, possibly used by scam networks whose tools break standard encryption behavior.
At the heart of the issue, the researchers argue, is the flawed assumption that phone numbers make suitable identity tokens for a platform used by billions. Phone numbers simply do not contain enough randomness to serve as secure, secret identifiers—especially when the entire number space can be scanned. If WhatsApp insists on linking accounts to phone numbers for effortless discovery, they say, then no anti-scraping solution will ever feel airtight. WhatsApp is now testing usernames in beta, which could offer a more privacy-preserving alternative.
“Phone numbers were not designed to be used as secret identifiers for accounts, but that’s how they’re used in practice,” Judmayer says. “If you have a big service that’s used by more than a third of the world population, and this is the discovery mechanism, that’s a problem.”
{Matzav.com}