WhatsApp Contact Numbers Exposed On Google Search Results

WhatsApp has come under the radar for exposing personal phone numbers. What's worse, the phone numbers are available in public Google search results. The security lapse was discovered by security researcher Athul Jayaram, who notes that the WhatsApp Click to Chat feature has some security defects.

WhatsApp Personal Numbers Exposed

The security lapse was found on the WhatsApp Click to Chat feature, which allows website visitors to converse with website operators via the messaging service. For instance, if a visitor had a query about the particular website, he can simply scan the QR code, which opens to the WhatsApp chatbox to ask his queries.

However, Jayram found that this feature can pick the visitor's phone number in public search results, exposing the visitor to numerous cyberattacks and scams. The phone numbers are being exposed by the WhatsApp-owned "wa.me" domain, which stores Click to Chat metadata in a URL string (e.g. https://wa.me/).

These phone numbers are leaked on public Google search results because there are no stringent measures to prevent search engines indexing this metadata. "Your mobile number is visible in plain text in this URL, and anyone who gets hold of the URL can know your mobile number. You cannot revoke it," explained Jayaram to threatpost.

And since the personal phone numbers are out there, any attacker can message them, call them, or worse, sell their phone numbers to other third-parties, scammers, and so on.

Not The First Time

Facebook-owned WhatsApp has been in trouble before for various data leaks, including personal chat messages being exposed. However, having the user's number available on Google search is even more serious, as phone numbers are further linked with bank accounts. WhatsApp recently enhanced a couple of features with its latest update, allowing up to eight people to video call at a time with end-to-end encryption.

"Today, your mobile number is linked to your Bitcoin wallets, Adhaar, bank accounts, UPI, credit cards...[allowing] an attacker to perform SIM card swapping and cloning attacks is another possibility," Jayram further added. While WhatsApp offers end-to-end encryption to its users, the latest discovery suggests that personal data isn't as safe and secured as users might think.