Showing posts with label Whatsapp. Show all posts
Private WhatsApp Groups Exposed On Google Search, But It’s A Feature [Update]
Don't share WhatsApp Group invite links on public platforms.
Update (24/02/2020, 7:00 PM IST): Initially, it seemed that WhatsApp didn’t give users even a single ray of hope after their private chats ended up on Google Search and on other search engines as well.
Update (24/02/2020, 7:00 PM IST): Initially, it seemed that WhatsApp didn’t give users even a single ray of hope after their private chats ended up on Google Search and on other search engines as well.
But according to an update posted by Jane Wong, the company was working quietly behind the curtain. Now, making a search for the said private chat invite links on Google brings nothing but an error message. Whatsapp has delisted the invitation links from Google by including the “noindex” meta tag.
The original post continues from here.
Google is indexing the invitations to the WhatsApp Group chats, including the links to join private groups as reported by Vice. As a result, the links are available for people all around the globe to join any discoverable group.
Multimedia journalist Jordan Wildon tweeted and raised a question over WhatsApp’s security. He said that WhatsApp’s ‘Invite to Group via Link’ feature permits Google to index groups, which then become available all over the internet for everyone to join.
Vice discovered several private groups with the help of specific search queries. The result page consisted of a lot of groups meant for porn sharing. Once anyone joins the group, they have permission to view all the participants and their phone numbers.
Popular reverse engineering enthusiast Jane Manchun Wong said in her tweet that a misconfiguration from WhatsApp is allowing Google to index group invite links. She suggested that there are ways to deindex the invite links from Search.
A WhatsApp spokesperson said that group admins can invite any user to join their group by sharing the invite link. Like all other content available on the open web, invite links posted on public platforms are also searchable. He concluded his statement by saying that admins should make sure that they share the group link with trusted people only.
Google’s Take
Google refused to comment on the scenario going on. However, Google official Danny Sullivan tweeted that search engines like Google index pages from the open web. The same thing happened in the case of invite links to WhatsApp groups.
He concluded by saying that WhatsApp as a website has allowed listing the invite links publically. Sullivan also added a link in his tweet, which redirected people to the Help Center to block content to be displayed from the Google search results.
So, it seems that things are designed this way, even if they pose a threat to users’ privacy. Users are advised not to share personal WhatsApp group links on public platforms until WhatsApp announces any under-the-hood changes.
Are Your WhatsApp Encrypted Group Chats Exposed To Strangers?
A team of security researchers from the Ruhr University of Bochum, Germany has revealed a series of vulnerabilities in the popular instant messaging app WhatsApp.
According to a Wired report, the flaws allow a person with the control of WhatsApp’s servers to add anyone to a WhatsApp group without admin permission.
Once added to a group, the respective encryption keys of all the group members get shared automatically with the new user. So, a newly added eavesdropper can easily read all the new end-to-end encrypted messages exchanged between the members. But not the older messages and the ones for which the stranger doesn’t have the end-to-end encryption key.
The report was quick to ring the bell at the house of WhatsApp’s daddy Facebook. Its chief security officer Alex Stamos made multiple tweets as a response to Wired’s report.
“Read the Wired article today about WhatsApp – scary headline! But there is no a secret way into WhatsApp groups chats. The article makes a few key points.”
“Everyone in the group would see a message that a new member had joined,” he argued. But should that be considered as a safety measure, relying on the alertness of the members to make sure some eavesdropper has not entered their WhatsApp group?
“WhatsApp is built so group messages cannot be send to hidden users and provides multiple ways for users to confirm who receives a message prior to it being sent.”
Stamos said that WhatsApp has seen the researchers’ findings. But preventing a possible attack would require to let go of a popular feature called “group invite links” which allows anyone with a link to join a WhatsApp group. “There may be a way to provide this functionality with more protections, but it’s not clear cut.”
Even if such an attack could be performed, how many people would have access to WhatsApp’s servers except their employees and governments wanting to conduct surveillance? An experienced hacker would first have to compromise the servers before adding an eavesdropper to the group.
According to Maxie Marlinspike, who developed the Signal protocol, it’s not possible to suppress the alerts sent when someone joins the group, contrary to the researchers’ claim. It turns out, it’s not possible for someone to snoop into group chats and hacking the servers is not that easy.
Commenting on the report, Mike said that the article is a better example of the problems associated with security industry and how research is done today. “I think the lesson to anyone watching is clear: don’t build security into your products, because that makes you a target for researchers, even if you make the right decisions,” he wrote.