Top
Best
New

Posted by KingNoLimit 11/19/2025

Researchers discover security vulnerability in WhatsApp(www.univie.ac.at)
310 points | 138 commentspage 2
chatmasta 11/20/2025|
This is not a security vulnerability, it’s been documented in the user interface for years. That’s why I have no profile picture and no status. You clearly opt into “everyone” viewing it, and it’s obvious this it is literally anyone, because when you add a new contact, you simply enter their phone number and can see their profile picture and status. It doesn’t take a leap of imagination to enumerate that for the space of valid phone numbers.
porridgeraisin 11/20/2025|
There is a way to show profile pictures to only contacts. It's a setting.
chatmasta 11/20/2025||
Yes, and those people didn't get their profile pictures exposed through this phone number enumeration. If they had, then maybe it would have qualified as a security breach.
throwaway290 11/20/2025||
> Yes, and those people didn't get their profile pictures exposed through this phone number enumeration.

They did and this was not enumeration, did you read post?

chatmasta 11/20/2025||
The post with the headline “Worldwide enumeration of accounts was possible?”
throwaway290 11/20/2025||
OK... but it's not phone number enumeration. You need to give it a phone number to check if whatsapp acc is registered for it. So you need to have a collection of phone numbers first. If you have a collection of all phone numebrs in the world then you could enumerate whatsapp accounts.

And yes the pictures were leaked in the process.

hashhar 11/20/2025||
It's trivial to enumerate all the phone numbers in the world.
throwaway290 11/20/2025||
exactly. to claim enumerating phone numbers is a whatsapp bug is stupid. and to say profile pictures were not revealed = not reading tfa.
yorwba 11/20/2025||
"The accessible data items used in the study are the same that are public for anyone who knows a user's phone number and consist of: phone number, public keys, timestamps, and, if set to public, about text and profile picture." Source: TFA, which I read.
throwaway290 11/20/2025||
From my understanding the accessible data items meant they got them through the bug? Maybe I read wrong
ale42 11/19/2025||
A bit disappointing, I thought everybody knew it was possible to "enumerate" Whatsapp accounts? I was hoping for something more juicy like RCE...
ruinin 11/19/2025||
The most interesting vulnerability is the reuse of cryptographic keys, some of it apparently by design, like when transferring one's account to a new number - this can apparently be used to correlate identities despite the change of phone number.

Also, from examining the published data set I found it interesting that there are only five WhatsApp users registered in North Korea. I wonder who they are.

SweetSoftPillow 11/19/2025|||
I'm almost 100% sure that one of them is the only North Korean Steam user.
jeingham 11/19/2025|||
I hope nobody tells Kim there are another four users. I'm not sure their prison system can handle anymore, pretty well booked up last I heard.
userbinator 11/20/2025||
If anything, the other four are likely to also be Kims.
0cf8612b2e1e 11/20/2025||
The lack of rate limiting was surprising.
ale42 11/20/2025||
Yes, indeed, I wouldn't have expected to be possible to enumerate all of them in a short time from a single IP.
wang_li 11/20/2025||
If this is a security vulnerability, then these guys just documented their exploitation of said vulnerability. Sounds like a crime.

Proper research would be to identify an issue, write up the issue, conduct a handful of tests, report the issue. Improper research is enumerate the entire input space and gather as much data as you can from the target.

TZubiri 11/19/2025||
Security vulnerability is a bit strong, but I don't blame news salesmen for making clickbait, it's all in the game
Krasnol 11/19/2025|
If you can identify a person in a country where WA shouldn't be available by sniffing out their profile, it may even end up being a deadly security vulnerability, but I don't blame someone on a tech bro forum for making a edgy comment, it's all in the game.
perch56 11/19/2025|||
In a kinetic warfare or authoritarian context, this is rather a life safety vulnerability. In the industry, we call this the crossover from Information Security (InfoSec) to Operational Security (OpSec), where a digital flaw becomes a Kinetic Threat.
TZubiri 11/20/2025|||
Right, but if a country being at war or in a authoritarian regime is a precondition for the vulnerability to pose a threat, it's not really a scenario that would warrant a high scoring in some vulnerability scoring system. For sure it's a weakness and would score higher if the purpose of the technology were military.

But since this is a civilian application and not military, it doesn't seem sensible to rate vulnerabilities according to military use. The intended scope of the application makes a huge difference legally and operationally and should be triaged accordingly.

catmanjan 11/19/2025|||
[flagged]
j16sdiz 11/20/2025||||
To create a whatsapp acccount, you need to authenticate with sms first. If the country is that strict around whatsapp, this alone would bring you trouble.
varenc 11/20/2025||||
The vulnerability here is that the contact discovery endpoint could be abused to enumerate all WhatsApp users en-masse.

It's still quite possible to discover a single or small set of existing WhatsApp users based on their phone number. So in your scenario the risk still exists, it's just more work to enumerate everyone. Everyone should still assume their phone number can be linked to their WhatsApp account.

TZubiri 11/20/2025||
>Everyone should still assume their phone number can be linked to their WhatsApp account.

But this has always been the case, the phone numbers are public, and phone numbers are the public key to whatsapp accounts.

Also you always could check a specific number to see if it is a whatsapp user. It is certainly an issue if a single actor can query 500 million users in a matter of minutes, and there seems to be some additional information per account like what device they are in. But these seem relatively minor.

varenc 11/20/2025||
we agree. Just pointing out to the parent commenter that in their scenario the risk hasn't fundamentally changed. Just before the vuln was fixed it was a bit easier.
Hnedelin 11/20/2025||||
Governments in these countries have full and absolute control over ISPs and phone operators. If they didn’t already know someone is using whatsapp, they are not totalitarian governments to begin with. And who in their right mind would use whatsapp in those countries? There are much better and safer alternatives.
TZubiri 11/20/2025||||
Is it edgy? I find it somewhat nuanced and sensible. What is a bit proper of pseudoanonymous tech bro forums is people larping as military grade security analysts in a forum because they are unable to live out that dream in an actual scenario where they have any power on.

If the application is actively distributed in a country and their usage is permitted by their Terms of Service, then yes Whatsapp is liable for the security of their users in that context. If however the application is not actively distributed in that country, and there are active measures like geolocalization (and asking the user what country they are from during signup) to avoid serving such countries, then usage in those countries is outside the scope of Whatsapp.

Furthermore Whatsapp is a civilian app and is not designed or guaranteed for military usage, it's outside the scope of whatsapp.

Can the technique be used as one tool of many (including a bullet) in order to kill someone? Yes, is this a deadly security vulnerability? No, of course not, that's reaching, I'm not sure what would compel these exaggerations, maybe the larping, maybe its a general hatred towards whatsapp and you just jump on any opportunity to release your pent up anger.

It's worth noting that there's a gap between the security capabilities of whatsapp and the security capabilities they are legally required to have. Whatsapp will no doubt patch this small issue and keep that gap, but WA as it stands is one of the most secure and widely used applications in the world, has had an almost impollute historical record which is why billions of users trust the application with personal and professional secrets.

P.S: Also, you always could find out if a phone number is a whatsapp user individually, just add them on whatsapp and try to message them.

Krasnol 11/20/2025||
Wow so much unrelated drama combined with pretty interesting advertisement.

Do you work for Meta?

People don't use WhatsApp because it's so secure. In certain countries people started using it because it was the first app that was cheaper than SMS and now they use it because everybody else is still using it. There is no other significant reason.

They have a history of security issues going back to 2011 when you could take over other peoples account. Today is just the last story of this ugly and leaking brother to Signal. The actually "most secure" app out there.

loeg 11/20/2025|||
> If you can identify a person in a country where WA shouldn't be available by sniffing out their profile, it may even end up being a deadly security vulnerability,

What are you talking about? Like what is even the mechanism for your concern?

This is an open endpoint / not a part of the design that is intended to be confidential. If you suspected any particular individual you could always check if their phone number had a WA account.

londons_explore 11/19/2025||
The only fix to this is to replace phone numbers by secret 256 bit keys that are never reused...

Never gonna happen.

nicce 11/19/2025||
WhatsApp has avoided the pressure of E2EE backdoors and whatever politics because they were never needed.

1. They collect all the metadata in unencrypted format and link it to phone numbers, making a huge social graph.

2. Backups are not encrypted by default and enabling of them is pushed. So the messages were never actually encrypted for most people and police can get messages without the actual phone.

3. iCloud E2EE backup fight in UK was mostly because of 2. as people started to opt-in for encryption.

gruez 11/20/2025||
>3. iCloud E2EE backup fight in UK was mostly because of 2. as people started to opt-in for encryption.

That doesn't make any sense. Why did uk want to start a fight over icloud E2EE backups (opt-in) but not whatsapp E2EE backups (opt-in)?

nicce 11/20/2025||
> That doesn't make any sense. Why did uk want to start a fight over icloud E2EE backups (opt-in) but not whatsapp E2EE backups (opt-in)?

Default iCloud backup always included WhatsApp too, even if it was disabled in the app or the app used encrypted backups. And many other things, so it was not only about WhatsApp. Even for WhatsApp alone, it was slightly more useful.

tamimio 11/19/2025|||
That’s not gonna happen because the whole idea is to link your real identity to the digital one, which is why you should never trust any company that refuses to give you an alternative option to the phone number.
jojobas 11/20/2025||
But it's to combat spam, we swear! Because of course there is no spam in whatsapp!
londons_explore 11/20/2025||
Spam in WhatsApp is super low.

Of 10,000 received messages, perhaps 2 are spam?

Sophira 11/19/2025||
Phone numbers were never supposed to be secret.

Nor were social security numbers.

hdgvhicv 11/19/2025|||
We used to put phone numbers and addresses in printed books and give them to everyone.
netsharc 11/20/2025||
I remember looking in a 1930's phone book for Zurich, and it even mentions the person's job (I guess for significant jobs like company owner)...
ta20240528 11/20/2025||
Norway still publishes everyone's tax returns.
netsharc 11/20/2025||
But now you need to enter your own tax number to lookup other people's data, and they can see that you've been peeking.

But I suppose one could start a service, so you could pay them to look up a 3rd party's tax returns...

hsbauauvhabzb 11/20/2025|||
Phone numbers are treated as permanent even though they’re ephemeral. So here we are.
zgk7iqea 11/19/2025||
Is phone number enumeration now considered a vulnerability? Really?
hekkle 11/20/2025|
I know, remember when the telco's just published those in books every year?
alister 11/20/2025|||
But you had the option of having an unlisted or unpublished phone number. To give one datapoint, in Los Angeles in the 1980s about half of all numbers were unlisted. I would expect that the unlisted rate was much higher in big cities like L.A. compared to the rest of the country.

What I find fascinating is that people paid for privacy. Yes, indeed, people paid several dollars extra per month to maintain an unlisted/unpublished phone number. Today very few people are willing to pay actual money for privacy.

BobbyTables2 11/20/2025||
Very good point.

Everyone I knew while growing up was in the white pages (parents) with home address, not just phone number.

The early “FreeNet” and ISPs like Compuserve used anonymous usernames. Personalized email addresses came later…

Oddly, because we can’t even pay for privacy today, it appears as if nobody cares. Sure, still desirable but not even an option at any cost.

How we got from there to here is troubling.

Hnedelin 11/20/2025||
What do you mean we can’t pay for privacy and it’s not an option at any cost? Just don’t use big tech services, you pay for them with your data. Use Threema instead, or similar. It is a paid service with focus on privacy.
BobbyTables2 11/27/2025||
One would nearly have to live like the Amish to avoid all online services.

Both free and paid online services make extensive use of 3rd party tracking services.

Sure, if one has a flip phone and lives as one did in the 1980s…

dylan604 11/20/2025||||
funny thing is, there's probably a decent percentage of people here that don't remember this
austinjp 11/20/2025|||
Sarah Connor?
vachina 11/20/2025||
I’ve actually thought of doing this myself, but there isn’t really much value in enumerating active phone numbers. Lest you run a full scale scam operation cold calling people to phish for their banking info.

My entire PII is already leaked elsewhere in other breaches.

mlmonkey 11/19/2025||
"security vulnerability" ....
rubenvanwyk 11/20/2025|
I can't imagine the scrutiny you must face when your product becomes so mainstream that researchers literally work on identifying security vulnerabilities.
More comments...