WhatsApp groups are popping up on Google search again. As a result, anyone could find out and join a private WhatsApp group by simply searching on Google. This was first discovered in 2019, and appears to have been fixed last year after it went public. Another old issue, which seemed to be established but seems to be growing again, is the emergence of user profiles through search results. Because of the issue, people’s phone numbers and profile pictures could come to light through a simple Google search.
By allowing an index of group chat invitations, WhatsApp is making several private groups available across the web as their links can be accessed by anyone using a simple Google search query – although we are not sharing the real details, this was confirmed by Gadgets 360 Someone who finds these links can join the groups and would be able to see their partners and phone numbers along with the posts be divided within these groups.
Cybersecurity researcher Rajshekhar Rajaharia contacted Gadgets 360 about the WhatsApp group chat invitation index on Google. It seems that the index has recently restarted. At the time of writing, more than 1,500 group links were available in search results.
Some of the links recorded by Google lead to WhatsApp groups sharing porn. In a few other cases, there were links to WhatsApp groups dedicated to a particular community or interest. Find Gadgets 360 organizations also share messages for Bangla and Marathi users. With the links, uninvited people could join the groups.
This is not the first time this issue has occurred. In November 2019, WhatsApp group chat invitations were first detected on Google search results. The case was reported to Facebook by a security investigator, although it was resolved shortly after it was covered by several news outlets in February last year.
Rear engineer Jane Manchun Wong recitation WhatsApp appeared to be on a group chat index set by placing the meta tag ‘noindex’ on the invite chat. However, the new links include a noindex meta tag.
The group chat links that appeared in the 2019 period are not visible on Google, so this could be a different issue leading to similar results, or a change that brought an old problem back to unfortunate.
Rajaharia told Gadgets 360 WhatsApp had not imported the robots.txt file specifically for the chat.whatsapp.com subdomain which led to an index of group chat invitations on Google and other search engines. Web developers typically use a robots.txt file to tell search engine crawlers which pages or files they might crawl and which they should not index.
WhatsApp makes user images public on Google
Along with group invitation links, WhatsApp seems to have allowed Google to once again index user profiles to allow anyone to chat with a user or view their profile picture.
By finding country codes on the WhatsApp domain, it was possible to surface the URLs of people’s profiles, which included phone numbers and profile pictures. This issue appeared to have been resolved by WhatsApp in June last year – the company had not issued a statement at the time but several reports had confirmed this as well.
Gadgets 360 found that similar to the group chat inviting index, WhatsApp user profiles are also available again on Google for the next few hours. The search engine was already making a record of more than 5,000 profile links. Some links also lead to users who have enabled their profile pictures and images to anyone on the messaging app.
Cybersecurity researcher Rajaharia found an index of WhatsApp user profiles on Google. He noticed just as the group chat invites, there is no specific robots.txt file for the api.whatsapp.com subdomain to tell search engine crawlers not to crawl the links associated with it.
Gadgets 360 has reached out to WhatsApp and Google to get an idea of both group chat inviting link index and user image issues.
What’s the most exciting tech launch in 2021? We discussed this on Orbital, our weekly tech podcast, which you can subscribe via Apple Podcasts, Google Podcasts, or RSS, download the program, or just hit the play button below.