WhatsApp exposed users' phone numbers in Google search results

Security researcher claims 'Click to Chat' feature revealed as many as 300,000 phone numbers via public search

WhatsApp, Web app, Messaging

Facebook-owned messaging service WhatsApp exposed as many as 300,000 users' phone numbers through public Google search results.

That's according to India-based researcher Athul Jayaram, who revealed that WhatsApp's 'Click to Chat' feature – a tool that allows users and small businesses to generate a URL through which other users can get in touch with them directly – does not use encryption to hide the user’s phone number in its link.

This "privacy lapse" means that some 300,000 phone numbers appeared in Google search results if someone looked up for “site:wa.me”.

"This feature does not encrypt the phone number in the link, as a result, if this link is shared anywhere, your phone number is also visible in plaintext," Jayaram said.

"For example, you share this link with a friend on Twitter to reach you on WhatsApp. Your mobile number is visible in plain text in this URL and anyone who gets hold of the URL can know your mobile number, you cannot revoke it."

This is because the 'https://wa.me' URL does not have a robots.txt file in its server root, which means Google and other search engine bots can not be prevented from crawling and indexing the links.

The Google listings didn’t reveal any other personal information, though Jayaram claims he could view the pictures and names of people who hadn’t made their data private through WhatsApp’s security options.

Users affected are from the UK, US, India and "almost all other countries".

Jayaram reported the issue to WhatsApp owner Facebook through its bug-bounty scheme, though the company said the disclosure did not quality for a reward.

Related Resource

IT Pro 20/20: How regulation is shaping innovation

The fifth issue of IT Pro 20/20 looks at how new rules are forcing companies to change the way they do business

Download now

"While we appreciate this researcher’s report and value the time that he took to share it with us, it did not qualify for a bounty since it merely contained a search engine index of URLs that WhatsApp users chose to make public," a spokesperson said. "All WhatsApp users, including businesses, can block unwanted messages with the tap of a button."

Jayaram, however, believes the firm should take the disclosure more seriously: “Today, your mobile number is linked to your Bitcoin wallets, Adhaar, bank accounts, UPI, credit cards…[allowing] an attacker to perform SIM card swapping and cloning attacks is another possibility,” he said.

News of this security lapse comes just weeks after researchers revealed that WhatsApp users were susceptible to shoulder surfing attacks due to the way the service restores accounts to new devices, with hackers able to compromise individuals using just their phone number.

Featured Resources

Managing security risk and compliance in a challenging landscape

How key technology partners grow with your organisation

Download now

Evaluate your order-to-cash process

15 recommended metrics to benchmark your O2C operations

Download now

AI 360: Hold, fold, or double down?

How AI can benefit your business

Download now

Getting started with Azure Red Hat OpenShift

A developer’s guide to improving application building and deployment capabilities

Download now

Most Popular

IT retailer faces €10.4m GDPR fine for employee surveillance
General Data Protection Regulation (GDPR)

IT retailer faces €10.4m GDPR fine for employee surveillance

18 Jan 2021
Citrix buys Slack competitor Wrike in record $2.25bn deal
collaboration

Citrix buys Slack competitor Wrike in record $2.25bn deal

19 Jan 2021
Should IT departments call time on WhatsApp?
communications

Should IT departments call time on WhatsApp?

15 Jan 2021