An independent computer security researcher, Athul Jayaram , revealed that the phone number of a large number of WhatsApp users could be found by searching in plain text on Google Search.
Jayaram explained on his blog that he found a security problem on the WhatsApp website. According to Jayaram, the bug has allowed around 300,000 phone numbers of WhatsApp users to be leaked in a way that anyone using the Internet can access.
According to Jayaram, affected users are from almost every country on the globe, including the US, Mexico, Indonesia, the UK, India, Russia, China, Spain, Pakistan, Malaysia, and many more. And the seriousness of the security failure is that it allows access to information on the open web , not on the dark web or darknet.
According to the expert, the company could have avoided this privacy problem if WhatsApp encrypted users’ phone numbers and included a robots.txt file. This would have prevented the bots from crawling the domain, as well as an unindexed Meta tag on the pages. However , WhatsApp had not taken these measures into account.
Jayaram elaborated that WhatsApp should be more concerned about security vulnerabilities as the platform has a large user base. Today, many people’s phone numbers are connected to their online services, bank accounts, credit cards, and cryptocurrency wallets, etc. If a hacker knows the phone numbers of users, there is a possibility that they could lead you to swap SIM cards and carry out cloning attacks.
Due to this privacy issue, unknown individuals, cybercriminals, marketing executives and scammers can find the mobile phone number of users. If a person had set WhatsApp privacy to public mode, this privacy issue can help scammers to access personal data such as profile status, profile name or picture, etc. Jayaram recommended that the best solution is to delete the WhatsApp account or change the phone number.
The “setback” lies in WhatsApp’s ‘Click to Chat’ feature that allows users to have conversations with people without saving their numbers. The function generates the URL “https://wa.me/. Creates the link for the conversation but does not encrypt it , exposing the phone number as there is nothing to prevent Google from seeing and indexing it and, as individual phone numbers are leaked, an attacker can message them, call them, and sell their phone numbers to sellers, spammers, or scammers – anyone with this URL can know the mobile number.
Be that as it may, WhatsApp claims to have temporarily fixed (and is working to resolve it permanently ) the problem that displayed users’ phone numbers in Google search results. It is not the first time that a security hole of this type has been alerted in WhatsApp. While the problem appears to be fixed, it is a fairly large security flaw and has apparently been going on for at least several months.
To find out if a mobile number has been leaked:
Search in Google: site: https: //api.whatsapp.com/send? Phone = +34 XXX (where XXX is the first three digits of the phone).
