WhatsApp, which is owned by Facebook, warns that using this vulnerability violates its terms of service. A representative said that providing an email address with your two-factor authentication credentials can help avoid this hypothetical scenario, but that still puts the responsibility on WhatsApp for actually following its own best practices. But when pressed for comment, WhatsApp was evasive, and did not indicate that it’s working to resolve the hole in its security. There’s no indication that this technique is being used in the wild. YOU MAY ALSO LIKE: COVID-19: FG Charges Traders, Transporters Over Inflation Confidential text messages and contacts are not exposed. The results are disturbing, but at the very least, this method can’t be used to actually gain access to an account, merely to block access by its legitimate owner. The attack is a proof-of-concept from a pair of security researchers, Luis Márquez Carpintero and Ernesto Canales Pereña, and was first reported by Forbes. The attacker can repeat the process several times in succession to create a semi-permanent lock on your account.Ī demonstration of a semi-permanent WhatsApp account lock.

WhatsApp “verifies” this with a reply email, and suspends your account without any input on your end. Here’s where the tricky part comes in: with your account locked, the attacker sends a support message to WhatsApp from their email address, claiming that their (your) phone has been lost or stolen, and that the account associated with your number needs to be deactivated. After multiple repeated and failed attempts, your login is locked for 12 hours. They can’t verify it, because of course, the two-factor authentication system is sending the login prompts to your phone instead. The attacker installs WhatsApp on a new device and enters your number to activate the chat service. This newly-discovered flaw uses two separate vectors.

Your whatsapp number be suspended by