Hang onto your phone — and your phone number — if you’re a WhatsApp user who doesn’t want to fall victim to a very simple trick that would let cybercriminals break into and take over accounts for their own purposes.
The Hacker News was the first to report the exploit, insisting it was merely trying to raise awareness. The technique is not an actual flaw in the WhatsApp’s software so much as a trick that even someone with little to no technology expertise could use to compromise users’ personal information and gain access to their contacts. When someone sets up an account, the confirmation and authorization process involves sending a unique personal identification number to the account holder. All cybercriminals would require is a few minutes with the victim’s mobile device and they could steal the number in seconds.
As Sophos commented on its Naked Security blog, Facebook, which owns WhatsApp, is unlikely to do much about this kind of security threat because maintaining physical control over a smartphone is really a consumer’s responsibility. On the other hand, it pointed out that changes in mobile technology could make such risks even bigger. For example, Apple’s virtual assistant Siri can be used to answer all kinds of questions. If technologies like that become part of a lock screen — which is often the case, given the convenience it provides — getting a security code could be particularly easy to do.
The video showing how to steal WhatsApp account data has already been embedded on a number of sites, which may tempt some cybercriminals try it out, though it would obviously also require some social engineering and a fair degree of luck.
This isn’t the worst security issue to face the popular messaging app in recent months. Back in February, the U.K.’s Daily Mail reported on a more serious flaw in WhatsApp that let cybercriminals bypass privacy settings and track users. A Dutch developer showed how a problem in the service’s “optional status” feature could continue to provide third parties a detailed look at what users do on the app, where they were and so on.
Just a few weeks later, the International Business Times said cybercriminals were using spam messages targeting WhatsApp users that could lead them to download malware. For a messaging tool that became a pretty hefty acquisition, Facebook may have a number of security issues on its hands.