New Delhi: A new security vulnerability that has been uncovered within WhatsApp has leaked the phone numbers of almost all users of the social network platform, an estimated 3.5 billion users, even though Meta was notified of the problem as early as 2017. The study conducted by the University of Vienna found that WhatsApp had an option of contact discovery and enabled an endless number of checks on phone numbers, which means it was possible to scrape user data at a scale unmatched before. The team managed to get hold of 30 million U.S. numbers in just 30 minutes and later on billions of other numbers worldwide, reported by Wired.
Meta claims that it has since added new rate limits security; however, critics point out that the solution took years to be announced. The company claims that none of the bad actors took advantage of the vulnerability and messages were securely transferred via end-to-end encryption. Researchers caution that had this loophole been taken advantage of by cybercriminals, it would have created the biggest data leak ever recorded.
A simple feature, a massive privacy riskThe problem turned out to be based on the convenience of WhatsApp, which instantly verifies the connection to the account through the phone number. Automating this verification on billions of potential combinations of numbers, researchers could silently map users and photograph profiles and descriptions of their pages without any security halo taking effect. Simple rate controls were not implemented, and therefore the attack was cheap, fast and highly scalable.
Although Meta was warned about the vulnerability as early as 2017, it did not act to enhance security until an Austrian team proved the extent of the exposure. According to the company, the experiment was conducted to test its new anti-scraping systems, thereby stressing them, and ensured that there was no access to any personal messages or the secret data. The researchers have destroyed the database they had collected; however, the incident brings up again the issue of the slow reaction of Meta to prior threats to security.
