Key Takeaways
1. Data Collection Vulnerability: Researchers exploited a security flaw in WhatsApp’s contact discovery feature, revealing the identities of 3.5 billion users.
2. Massive Query Capability: The flaw allowed for the potential lookup of 100 million phone numbers every hour due to a lack of proper rate limits for queries.
3. Database Creation: The research resulted in a vast database of active WhatsApp accounts, showing publicly accessible metadata like profile photos and last seen details.
4. Meta’s Response: Meta has implemented strict rate limits to prevent mass queries, although they claim no evidence of prior exploitation exists.
5. Implications of Shared Keys: Researchers discovered groups of phone numbers sharing the same public key, indicating the use of unofficial software that compromises WhatsApp’s security.
Security researchers from the University of Vienna and SBA Research have shown a worrying example of how data can be collected on WhatsApp. The team was able to reveal the identities of all 3.5 billion users by utilizing the messenger’s contact discovery feature. This feature is supposed to help users check the contacts in their own address book.
Exploiting Security Flaws
The researchers took advantage of a significant security flaw, which has now been patched. They found that the interface lacked proper rate limits for queries. This allowed them to potentially look up a staggering 100 million phone numbers every hour. They simply scanned complete phone number ranges. The study has been shared on GitHub, and the scientists will showcase additional findings and analyses at the Network and Distributed System Security (NDSS) Symposium happening in San Diego from February 23 to 27, 2026.
A Massive Database of User Accounts
The results of this research created a vast database containing around 3.5 billion active WhatsApp accounts across the globe. Once a number was verified as registered, WhatsApp’s API (application programming interface) revealed publicly accessible metadata. This included profile photos, status updates, and details about the last time a user was seen online. Technical insights were also available, such as the types of operating systems used. For instance, the data indicates that about 81% of users globally are on Android, while iOS represents about 19%.
The researchers also looked at this data in relation to the significant Facebook data breach from 2021. Of the numbers leaked during that incident, 58% remain active today. This highlights how valuable large datasets can be, even after a long period. In places with strict internet censorship and bans on WhatsApp, millions of active users were still identified. Specifically, 2,333,519 accounts with Chinese phone numbers were found. Even in North Korea, at least five phone numbers were linked to WhatsApp accounts.
Meta’s Response to the Issue
Meta was alerted about the security vulnerability and has since taken steps to enforce strict rate limits, thus preventing mass queries at such speeds. Although the company claims there is no proof that third parties exploited the vulnerability, a thorough review of past attempts is nearly impossible from a technical standpoint. The method used is known among security experts, raising the possibility that it might have been previously used undetected by other parties.
Additionally, a technical aspect sheds light on the obscure workings of WhatsApp. Typically, each app installation generates a distinct cryptographic key pair necessary for end-to-end encryption and to authenticate the device’s identity. However, the researchers found groups of phone numbers sharing the same public key, which should not be possible with the official app on real devices. This shared key strongly indicates the use of unofficial software. Such tools are often employed in “click farms” or for marketing bots, where operators replicate identical security identities across numerous accounts for efficiency or due to poor implementation. This not only reveals fake accounts but also shows that these unofficial applications can significantly compromise the messenger’s security framework.
Source:
Link
