Of attackers, WhatsApp A vulnerability has appeared that makes it easier for him to remotely deactivate your account. Cyber security researchers Luis Marquez Carpenter and Ernesto Canales According to the information transmitted by a person who wants to have your account closed your phone number it is enough to know. Moreover, it is stated that even WhatsApp’s two-factor authentication protection cannot prevent this.
Someone who knows your number can close your WhatsApp account
The functioning of the new attack method revealed by Forbes magazine is as follows:
As you know, there is no username and password in WhatsApp. When you want to install the application from the store and log in, you have to write your number in the requested place. Subsequently, an SMS to your phone code You come and verify your account by entering it in the relevant section of the application.
There are certain limitations imposed by WhatsApp on this verification process. For example, a user verification code If he gets wrong 4-5 times can no longer ask for a new one. Gradually 60 minutes, 6 and 12 seconds He gets a warning telling him to wait. This is where the problem that jeopardizes the accounts of more than 1 billion monthly users begins.
A malicious person who knows your number has repeatedly heard of WhatsApp on your behalf. code wants. Of course, those codes reach your phone, but naturally you ignore it because you do not know about it. You can’t do anything. In the meantime, the attacker can use security codes. at random to enter It continues, WhatsApp does not accept it because it cannot write correctly. After a while, the platform’s firewall is activated. To request a new code in front of the attacker 12 seconds a warning pops up telling you to wait.
Seeing this, the attacker still continues to push the boundaries. To the WhatsApp support team [email protected] by reaching out via e-mail, “Hello, my account number xxxx has been stolen. Please close my account. “ Sending a message like that. WhatsApp support team, on the other hand, without questioning this and verifying the authenticity of the person who sent the mail, immediately out of order leaving.
So to summarize: The attacker, who asks for the security code on your behalf and enters it wrong over and over again, asks for help from the WhatsApp support team as if it wasn’t enough. It demands that the account of your number be closed. The interesting thing is that the support team “help” your request to accept without question.
What will those who encounter this problem do?
In front of users who are exposed to attack, suddenly “Your number is no longer registered on this phone.” A warning message appears. When the victim tries to verify their phone again, WhatsApp does not allow it. Due to repeatedly entering the wrong code for the same number 12 seconds he says he must wait. Up to 24 hours This period can sometimes be unlimited can become. In other words, the victim can no longer verify their account.
Cybersecurity writer for Forbes Zak DoffmanA few facts about what to do if faced with such a problem. shared. Doffman, victims From WhatsApp support team He said they should ask for help. Stating that even this is not a definitive solution, Doffman warned that users should pay attention.
In an email to Zak Doffman, a WhatsApp spokesperson said that the attack method in question was “Violation of terms of service” announced that it was. However, the spokesperson did not comment on the final solution of the attack.