Your WhatsApp Account Can Be Suspended By Anyone Who Has Your Phone Number

An anonymous reader writes: If you're a frequent user of WhatsApp, you may want to keep an eye on a disturbing hole discovered in its security this weekend. It's possible for an attacker to completely suspend your WhatsApp account, without any recourse for the individual user, and all they need is your phone number. At the time of writing there's no solution for this issue.

This newly-discovered flaw uses two separate vectors. The attacker installs WhatsApp on a new device and enters your number to activate the chat service. They can't verify it, because of course, the two-factor authentication system is sending the login prompts to your phone instead. After multiple repeated and failed attempts, your login is locked for 12 hours. Here's where the tricky part comes in: with your account locked, the attacker sends a support message to WhatsApp from their email address, claiming that their (your) phone has been lost or stolen, and that the account associated with your number needs to be deactivated. WhatsApp "verifies" this with a reply email, and suspends your account without any input on your end. The attacker can repeat the process several times in succession to create a semi-permanent lock on your account. The results are disturbing, but at the very least, this method can't be used to actually gain access to an account, merely to block access by its legitimate owner. Confidential text messages and contacts are not exposed. The proof-of-concept attack was first reported by Forbes from security researchers Luis Marquez Carpintero and Ernesto Canales Perena. There's no indication that it's being used in the wild.

I read about that!

[XXongo]

Yes, I remember reading about that [slashdot.org] on Slashdot.

Re:

[Tablizer]

One Can Create Duplicate Slashdot Stories Without Any Phone Number Whatsoever

Re:

[Tablizer]

Open Source Duplication Source

Re:

[Ostracus]

Progressive Slashdot, offering time-travel services to their members.

Dupe

[theshowmecanuck]

Super Dupe. Dupity Dupe.

Green?

[DontBeAMoran]

Super green!

again

[bloodhawk]

been a bad 2 days for Whatsapp with the same vulnerability coming up twice.

Looks like a serious issue

[GlennC]

Fortunately for me, I don't have a WhatsApp account.

They don’t need to have your number

[iamhassi]

All they need is to know your number, not have it. There’s a big difference between someone having my number and someone knowing my number.

Re:

[iamhassi]

If I ask “do you have Matt’s number?”, that’s asking if you know the number that is still being possessed by Matt. But this title says “anyone that has your number”, which could mean someone has taken possession of you number so they can use it to suspend you Whatsapp account. It’s poor phrasing by whoever submitted this.

Re: They don’t need to have your number

[VaccinesCauseAdults]

I think any fluent English speaker will interpret "anyone who has your phone number" to mean knowledge of the phone number, rather than ownership of the account or possession of the phone.

Translation:

[Narcocide]

There's no indication that it's being used in the wild.

When you see them say this, it usually means that it is something only being used on me or people trying to contact me and they're hiding the evidence.

Thank $DEITY

[Anne Thwacks]

Now I won't have to suspend it myself!