A nasty new surprise for WhatsApp’s 2 billion users today, with the discovery of an alarming security risk. Using just your phone number, a remote attacker can easily deactivate WhatsApp on your phone and then stop you getting back in. Even two-factor authentication will not stop this. Here’s how the attack works.
This shouldn’t happen. It shouldn’t be possible. Not with a platform used by 2 billion people. Not this easily. When researchers, Luis Márquez Carpintero and Ernesto Canales Pereñ, warned they could kill WhatsApp on my phone, blocking me from my own account using just my phone number, I was doubtful. But they were right.
“This is yet another worrying hack,” warns ESET’s Jake Moore, “one that could impact millions of users who could potentially be targeted with this attack. With so many people relying on WhatsApp as their primary communication tool for social and work purposes, it is alarming at what ease this can occur.”.
Despite its vast user base, WhatsApp is creaking at the seams. Its architecture has fallen behind its rivals. Long-awaited enhancements to enable multi-device access and fully encrypted backups remain in development. As the world’s most popular messenger focuses on mandating new terms of service to enable Facebook’s latest money-making schemes, these much-needed advancements remain “in development.”
And then we have the scourge of account hijacks. Month after month, we see warnings about various flavors of scams, where users are tricked into giving up the six-digit SMS code sent to activate a new WhatsApp install. And once an account has been hijacked, it can be time consuming and painful to restore. We have even seen stories about hijacked accounts leading to others accounts being blocked.
In fairness to WhatsApp, an account hijack requires a user error. Put simply, you must not send ANYONE a six-digit code sent to your phone EVER. It’s almost certainly a scam that will lead to one of your accounts being taken over. WhatsApp seems to be hit more than others by this issue, and should really mandate two-factor authentication (2FA) or develop a trusted device architecture, similar to Google and Apple.
Ironically, even WhatsApp’s two-factor authentication does not prevent the attack behind this latest warning. And that’s a real issue for any user who falls foul of this, because, even if they’ve followed all the security advice, it won’t help.
This newly disclosed security vulnerability involves two separate WhatsApp processes—both of which have a fundamental weakness. And it’s the combination of those two weaknesses that can deactivate your WhatsApp and stop you getting back in.
When you first install WhatsApp on your phone, or change phones, the platform will send you an SMS code to verify the account. Once you enter the right code, the app will ask for your 2FA number to ensure it’s really you, then you’re in.
Now, let’s start with the first weakness. Anyone can install WhatsApp on a phone and enter your number on the verification screen. You will then receive texts and calls from WhatsApp with the six-digit code. You will also see a WhatsApp app notification, telling you that a code has been requested, warning you not to share it.
An attacker can be doing this with your WhatsApp phone number while you continue to use your app as normal. They request repeated codes and enter incorrect guesses in their app. You will receive the SMS codes, perhaps calls as well, but there’s nothing you can do with them, there’s nowhere to enter those codes. And so, you ignore it all.
The issue is that WhatsApp’s verification process limits the number of codes that can be sent. After a few attempts, the attacker’s WhatsApp will say: “Resend SMS/Call me in 12 hours,” and so no new codes can be generated. WhatsApp also blocks code entries on the app after a number of attempts as well, telling the attacker “you have guessed too many times… try again in 12 hours.”
And so, while WhatsApp on your phone continues to operate normally, the attacker has blocked any new codes from being sent or from being entered into a verification screen. Everything is now dependent on that 12-hour timer, which is counting down.
None of this should be a problem for you. Unless you deactivate WhatsApp on your phone and need to reverify, there isn’t an issue. And so, to weakness number two.
The attacker now registers a new, fresh email address, Gmail will do, and sends an email to firstname.lastname@example.org. Lost/stolen account, the email, says, please deactivate my number. The attacker includes your number. WhatsApp might send an automatic email reply asking for the number again, the attacker complies.
So, to be very clear. WhatsApp has received an email referencing your phone number. They have no way of knowing whether this is really from you. There are no follow-up questions to confirm your ownership of the number. But an automated process has been triggered, without your knowledge, and your account will now be deactivated.
An hour or so later, and suddenly WhatsApp stops working on your phone and you see an alarming notification: “Your phone number is no longer registered with WhatsApp on this phone,” it says. “This might be because you registered it on another phone. If you didn’t do this, verify your phone number to log back into your account.” This deactivation appears to be automated, using keywords to trigger actions.
This happens even if you have 2FA on your WhatsApp account. But, even so, this still shouldn’t be a problem. You just need to request a code and reregister your account.
Your deactivated WhatsApp asks for your phone number to send you a code. You enter and confirm your number. But no text arrives. “You’ve tried to register [your number] recently,” the app tells you. “Wait before requesting an SMS or a call.”
Delay Requesting Code on Victim’s Phone WHATSAPP / ANDROID
Wait, what? You haven’t requested anything. But your phone is now subject to that same countdown as the attacker’s. You cannot request a new code for the balance of those 12 hours. You don’t know any of this, of course, you are totally confused.
But suddenly you remember that you received unexpected WhatsApp codes an hour or two earlier. You retrieve the most recent SMS and enter the code into WhatsApp. But even this will not work. “You have guessed too many times,” your WhatsApp tells you. Obviously, you haven’t guessed at all. But your phone has the same restrictions as the attacker’s. You can’t request a new code, you can’t enter the last code, you are stuck.
The countdown likely reads 10 to 11 hours at this point. If the attack stops here, you will be able to request a new SMS and verify your account using a new six-digit code after that 12-hour timer has expired. But there’s a nasty twist.
The attacker does not need to email WhatsApp during that first 12-hour countdown, instead they can wait and then repeat the process. You will receive lots more texts, but there’s still nothing you can do with them, albeit you’ll suspect something is wrong.
If the attacker does this, then on the third 12-hour cycle, WhatsApp appears to break down. “You have guessed too many times,” their app will say, “try again after -1 seconds.” There is now no way for the attacker to request or enter new codes, there is no countdown, instead of saying “12 hours” it says “-1 seconds.” It has stalled.
But unfortunately, your phone is treated the same way as the attacker’s—and so, if the attacker waits until now before emailing WhatsApp Support to deactivate your number, there will be no way for you to reregister WhatsApp on your phone when you are kicked out of your app. “It’s too late,” the researchers told me. You will need to contact WhatsApp and try to find someone who can help.
Even if the attacker deactivates your phone during the first cycle, they can push you into a second 12-hour countdown if they request and enter codes at the expiration of the first countdown before you get chance. Remember, they see the same timer as you.
Clearly, the combination of this verification architecture, the SMS/code limits and the automated, keyword-based actions triggered by incoming emails is open to abuse. There is no sophistication to this attack—that’s the real issue here and WhatsApp should address it immediately. There are many reasons why it might be advantageous to block someone from their go-to messenger. It shouldn’t be this easy. And this should not work when 2FA is enabled, as was the case on this “victim’s” app.
This isn’t complex and should be easily fixed. WhatsApp could ensure that an app on a device with 2FA registered can prevent this issue, using 2FA as a circuit breaker. Even more simply, when multi-device access eventually appears, WhatsApp could use the trusted device concept to enable one verified app to verify another. This is a much better system and would shut down this vulnerability.
According to Moore, this vulnerability has flagged another serious WhatsApp issue. “There is no way of opting out of being discovered on WhatsApp,” he warns. “Anyone can type in a phone number to locate the associated account if it exists. Ideally, a move towards being more privacy focused would help protect users from this, as well as forcing people to implement a two-step verification PIN.”
In response to the disclosure, a WhatsApp spokesperson told me that “providing an email address with your two-step verification helps our customer service team assist people should they ever encounter this unlikely problem. The circumstances identified by this researcher would violate our terms of service and we encourage anyone who needs help to email our support team so we can investigate.”
What they mean is that if you were to carry out this attack, you would be in violation of their terms of service and would face consequences. That doesn’t help any victims but should serve as a warning not to experiment with this vulnerability.
WhatsApp would not confirm that it plans to fix this vulnerability, despite the fact that it can be easily and anonymously exploited. Their response was to play down the risk—but that risk is very real. Beyond the nuisance factor, there are material advantages in taking someone “off comms.” So, given the widespread use of WhatsApp, this is a security gap that needs plugging. An attacker doesn’t even need a phone number to spoof a new install, a device connected over Wifi will work just fine.
Unfortunately, playing down the seriousness of security risks has become the in-house style at Facebook. Back in 2019, I reported on a vulnerability that allowed private user phone numbers to be pulled from Facebook databases at scale using automated bots. That hack was acknowledged by Facebook but dismissed as an “unlikely problem.” Some 533 million users might now disagree.
So, what should you do? You need to enable 2FA to prevent an actual account hijack, and it’s worth including an email address to help in the event that this happens to you. In the meantime, watch for warnings that someone has requested your verification codes, and if that persists, you should contact WhatsApp Support right away.
Of course, your other option would be to follow Mark Zuckerberg’s reported example and start to use Signal. The privacy-first messenger is the most viable alternative to WhatsApp and is ironically part funded by WhatsApp co-founder Brian Acton.
I remain hopeful that WhatsApp will change its stance and will fix this vulnerability—I will update this story if and when that happens.