NEW DELHI: WhatsApp is one of the world’s most widely used messaging apps. While the makers of the app have endowed the app with privacy controls and encryption to secure users messages, their usage pattern, profile picture and status message are still vulnerable. Simple software can be used to bypass users’ privacy settings on the mobile messaging app.
The vulnerability has been demonstrated by Maikel Zweerink, a Dutch university student who has developed WhatsApp, a web tool that can track every move of any WhatsApp user.
The student mentions that “the application is setup as a Proof of Concept that WhatsApp is broken in terms of privacy.”
By setting up a web server, users can track the Online/Offline status (even with privacy options set to “nobody”), profile pictures, privacy settings and status messages of users. The tool can even show on a timeline when exactly the user was online and for how long, and even let users compare it to another tracked user.
To run the tool you need a secondary WhatsApp account (a phone number that hasn’t been registered earlier with WhatsApp), a rooted Android phone or jail broken iPhone or knowledge of PHP code, and a web server, among others.
The developer of WhatsApp has invited users to send in their phone numbers if they want proof without setting up the server.
Recently, researchers had discovered security flaw in WhatsApp pictures that could show users’ profile picture to everyone even when they have been set to be viewed by friends only.
