WhatsApp easily exposed 3.5 billion people's phone numbers

"This has been revealed by Austrian researchers, who were able to extract phone numbers for all 3.5 billion WhatsApp users. And for around 57% of those 3.5 billion users, the researchers were also able to access their profile photos, and for another 29%, the text on their profiles. If you're wondering what black hat hacking magic trick they needed to use, well, none."

"All they did is basically try and add billions of numbers - in the same way you'd go about it. You add a number and then WhatsApp tells you if the person using that number has an account or not, and shows you their profile picture and account text. That's it, that's what these researchers did, only on a massive scale, using WhatsApp Web, the service's browser-based interface."

"They were able to check around 100 million phone numbers per hour earlier this year, since, despite WhatsApp parent Meta having been warned about this issue in 2017 by another researcher, it failed to do anything about it. Thankfully, the Austrian researchers notified it in April about the problem and by October, the company did implement rate-limiting to prevent such mass-scale contact discovery."

Austrian researchers extracted phone numbers for all 3.5 billion WhatsApp users. They accessed profile photos for about 57% and profile text for about 29% of those users. The extraction used automated additions of numbers via WhatsApp Web, exploiting contact discovery that confirms account existence and reveals profile images and text. The process ran at roughly 100 million number checks per hour. WhatsApp parent Meta received a warning in 2017 but did not mitigate the vulnerability until researchers notified again in April and rate-limiting was implemented by October. Meta stated the exposed data was publicly visible and reported no evidence of malicious abuse.

Read at GSMArena.com