These URLs could reveal your IP address on WhatsApp chats

We all must have heard about the highly-targeted attack which took the users in Southeast Asia for a ride using a combination of Wi-Fi router hacking along with some malicious apps. Users must also have seen the examples of fake WhatsApp apps that snoop on a user's phone data. Now a new bug exposes a user's IP address to WhatsApp chat.

As per some sources from the web, an independent cybersecurity researcher Rahul Kankrale has recently discovered a method which can steal anyone's IP address over WhatsApp. This is said to be achieved by making the potential victims click on a link which is sent as a WhatsApp message. The link is said to appear without any preview, unlike the regular links that show on the WhatsApp. The link exploits a user's natural tendency of clicking on any received 'mysterious' page link.

In a post, Kankrale writes that "Simple php code can disclose Whatsapp users ip and app version and save disclosed information to attackers server." "When link preview generated you can see IP get captured and at the same time this IP write over log file on attackers server" he further added.

WhatsApp live location sharing feature to Android and iOS

The report further suggests that Kankrale had already informed WhatsApp and Facebook, however, the company did not respond positively to the situation and said that fixing the bug would require disabling link previews, which is said to be handy for users. If a user wants to avoid falling prey to the newly discovered flaw, then it is highly recommended for the users to be wary of links received on WhatsApp. It is also recommended for the users that they do not click on links from alien-looking or unknown domains especially those who don't have any preview. A user needs to pay attention to the URL even if the link comes from a trustworthy source or shows a preview.

When it comes to attacks like these, they could be used for targeting the users who are not much aware of the current nature of cyber attacks. However, if the companies spread awareness about the cyber attackers who try to steal users data, then the damage would be minimized. It would be worth noting the fact that the compromised IP addresses could be used for phishing and email scams or they could also be used for more serious attacks.