WhatsApp Privacy can be broken as stated by an Independent Researcher from Netherlands, Maikel.pro.
In previous days, a sensational news hit the Internet telling a 17-year old found a critical bug in WhatApp. This time a security researcher from Netherlands has found a "broken-by-design" flaw in WhatsApp Privacy options, leading to successfully Spy on any WhatsApp number/user.
The scary words from Maikel.pro follows:
"So there is this menu called "privacy" in Whatsapp. Here you can edit your "last seen", "profile picture" and "status" privacy options. You may think now that you've set all options to "nobody" you are privacy-wise safe. But nevertheless I can still track your moves on Whatsapp."
Maikel has named this application, rather POC (Proof-of-Concept), as WhatsSpy Public. It is a web-oriented application that tracks every move of whoever you like to follow. The application is setup as an Proof of Concept that WhatsApp is broken in terms of privacy.
A user can be spied on the following things:
- Online/Offline status (even with privacy options set to nobody)
- Profile pictures
- Privacy settings
- Status messages
It tracks any change of profile pictures, privacy settings or statusses. This tool provided a simple GUI to view the timeline of a user or even compare it to another tracked user.
Where lies the broken Link ?
You may disable "last seen", "profile picture" and "status" but this won't disable this "online" message from showing up. Obviously a lot of people won't know this still happens, thus creating an pretty broken privacy settings. Due to this feature WhatsSpy Public can track virtually anyone, because anyone can listen for these events.
Why do Maikel consider this broken?
Privacy is the ability of an individual or group to seclude themselves, or information about themselves, and thereby express themselves selectively. -http://en.wikipedia.org/wiki/Privacy
The privacy options in WhatsApp act like they give you full control over your status in WhatsApp meanwhile they only affect a very limited scope. Sure, the last seen, profile picture and status options do work, but probably not as the user intended it to. The ability for a complete stranger to follow your in-app status is pretty creepy and might be abused already. This is not a "hack" or "exploit" but it's broken by design.
Technical Details
Maikel just started out this project as experimenting with WhatsApp to build a Bot, but he was stunned when he realized someone could abuse this "online" feature of WhatsApp to track anyone.
Requirements:
- Secondary Whatsapp account (phonenumber that doesn't use Whatsapp)
- Rooted Android phone OR Jailbroken iPhone OR PHP knowledge
- Server/RPi that runs 24/7
- Nginx or Apache with PHP with PDO (php5-pgsql installed) (you can't host on simple webhoster, you need bash)
- Postgresql
Maikel released proper Steps of Installation, Installation of WhatsSpy, Troubleshooting and other necessary information as a Proof-of-Concept for the public on his blog. Users who are interested upon agreeing to the above requirements can follow the mentioned link to install and start using WhatsSpy Public Application.
Warning: This project is launched under License (CC-BY-NC), by Maikel.pro, and anyone if uses the application and violates the law, is liable to his own work/damage done.
We suggest Users and Readers to work very carefully regarding this app and undergo Terms and Conditions completely before the installation of application.
