In one instance, it managed to easily access what seems to be a group for NGOs accredited by the UN.
Initially spotted journalist Jordan Wildon on Twitter, the backdoor isn’t a flaw in WhatsApp. Rather, the links to the groups have been shared in a public forum, making them open for indexing by Google’s search engine – no matter the intended privacy of the group.
A WhatsApp spokesperson told Motherboard:
“Group admins in WhatsApp groups are able to invite any WhatsApp user to join that group by sharing a link that they have generated. Like all content that is shared in searchable, public channels, invite links that are posted publicly on the internet can be found by other WhatsApp users. Links that users wish to share privately with people they know and trust should not be posted on a publicly accessible website.”
Google’s public search liaison even weighed in to point out this is just the web behaving like the web:
So the moral of the story is that if you’re an admin for a WhatsApp group, don’t post the link on your public Facebook page or blog because at some point you might well get someone snooping on your phone number or trying to join, all from a simple Google search.
Henry is Tech Advisor’s Phones Editor, ensuring he and the team covers and reviews every smartphone worth knowing about for readers and viewers all over the world. He spends a lot of time moving between different handsets and shouting at WhatsApp to support multiple devices at once.
