A feature offered by WhatsApp messenger, known as "Click to Chat", which allows Google to index users' phone numbers, has a problem.
As security researcher Athul Jayaram discovered , phone numbers of WhatsApp users can be found in Google search
The “Click to Chat” allows websites to quickly start WhatsApp conversations with their visitors. In short, the feature uses assigning a QR code to a phone number.
Thus, the website visitor simply scans the QR code or clicks the URL and can start a conversation on WhatsApp.
In short, it is a particularly useful option for spammers, as the security vulnerability will allow them to easily create well-structured databases of fake phone numbers to use in their malicious campaigns.
Athul announced that he managed to discover about 300,000 valid phone numbers from Google's search engine.
Although phone numbers are not linked to the names of their owners, attackers can learn who they belong to, since if they click on a phone number's URL in Google search results, a user's profile appears along with a photo.
WhatsApp denies the existence of the bug
When Athul Jayaram reported his discovery to WhatsApp, the company flatly denied his discovery and did not consider it a security flaw. According to a WhatsApp spokesperson, users themselves chose to make their phone numbers public.
However, Athul Jayaram, clarified his views on the flaw and recommended that the company immediately encrypt the mobile phone numbers of all app users and add a robots.txt file to prohibit bots from crawling their domains.
The flaw was fixed
WhatsApp patched the vulnerability shortly after the update and announced it online. A WhatsApp spokesperson said: “While we appreciate this report from the researcher and appreciate the time he took to share it with us, it does not qualify for a cash reward as it simply contained an index of URLs that WhatsApp users themselves chose to make public. All WhatsApp users, including businesses, can block spam with the click of a button.”
