Despite the fact that the most popular instant messaging application, WhatsApp, has end-to-end encryption and that, one of its main attractions is its commitment to privacy and security, a team of experts has discovered a vulnerability that allows, through Google, that a person can join any WhatsApp group chat.
How is it possible?
End-to-end message encryption is supposed to mean that only participants in a conversation or chat group can access the message content and user information. At least that’s what we thought.
However, it is possible to find WhatsApp links that lead to closed groups with a simple Google search. That’s right: Google allows users to find invitations to private groups and join without any problem. Links to WhatsApp groups have been indexed, exposing the conversations, files, phone numbers and other data of the members of these supposedly private groups.
Although WhatsApp group administrators can invalidate a link to a chat, what the application does is generate a new link and does not necessarily disable the original link to the group chat. Apparently, users just have to do an internet search using the domain chat.whatsapp.com, followed by any keyword to find the private groups. Every time a group administrator generates an invitation link and sends it, this url is registered in the Google search engine, allowing anyone to find it.
After the outrage on social networks by users when the news was known, the links have been removed from Google search results.
Yet despite this action, publicly available Internet archives continue to store data, as discovered by security researcher Lav Kumar, who collected and organized more than 60,000 unique links, which can still be found in vast numbers. of webs.
Without actively joining a group it is possible to see the creator’s title, description, image and phone number – they are available to everyone . And if you enter a group, you will be able to see the phone numbers of up to 256 participants, as well as other information, and adding these numbers to the contacts will also expose their names in the application.
WhatsApp, increasingly questioned
The app has experienced other security-related issues in recent months. An alleged hack of Amazon boss Jeff Bezos’ phone in 2018 was reportedly carried out via a malware-infected WhatsApp message. And last May, a vulnerability in the app was found to be being used to inject spyware into Android and iOS phones via WhatsApp phone calls. Even the EU and the UN recommend not using the popular messaging service given these multiple evidences that put the user’s trust in WhatsApp hanging by a thread.
Users can protect themselves from these defects by keeping their application always updated and avoiding the use of WhatsApp Web, the desktop version, and trying some alternatives to using this platform, such as Telegram or Signal.
