The Premise
The most interesting security findings aren’t just the result of intense research or extensive audits. More often than not, they are the byproduct of someone digging deep into their curiosity - following a random question until they finally satisfy their own need to understand, only to discover something unexpected along the way.
This article is about one such instance: how a random observation in WhatsApp eventually turned into a security finding, and how something seemingly insignificant can have an unexpectedly significant impact.
Rather than focusing on the vulnerability itself, this article explores the initial observation, the rise of curiosity, the investigation, and the thought process of mine that transformed the way I look at seemingly insignificant things.
Where It All Came Together
Like most discoveries, this didn’t begin with an audit or a desire to earn a bug bounty. Instead, it was discovered through simple curiosity that emerged while randomly exploring WhatsApp Communities and the Announcements channel.
At first, everything seemed fine and perfect until my fingers randomly clicked on everything lying around on the screen. I found a small inconsistency there. I left it there but came back later, wondering, "Why did that happen? Is it just happening to me, or to everyone else? Is it actually a real issue?"
But as I revisited it later on my device, I found the same inconsistency again. That's when I realized it wasn't just an inconsistency on my device, but that something else was hidden beneath it. I started digging deeper by researching and trying to understand what was actually happening.
Rather than dismissing it, I decided to follow that curiosity. What started as a simple question gradually evolved into an investigation that uncovered a privacy issue I hadn't expected to find.
Following The Thread
The first thing I wanted to know was whether what I had seen was just a one time occurrence or something I could reproduce.
I started testing the same interaction across multiple devices, different WhatsApp accounts, and several Communities. I also joined many Communities with only the default Announcements group so I could rule out anything unrelated. My goal wasn't to prove that I had found a vulnerability but it was simply to understand what was happening.
The results were confusing. Sometimes everything behaved exactly as I expected, and sometimes it didn't. I repeated the same tests again and again, trying different Communities, different accounts, and different scenarios. The inconsistency made the investigation even more interesting because it suggested there was another condition affecting the outcome.
As I ruled out one possibility after another, I realized I needed to understand how WhatsApp had actually designed this feature. Instead of continuing to guess, I decided to go back to the source and read through WhatsApp's documentation and feature announcements.
Understanding The Privacy Model
Before going any further, I wanted to understand how WhatsApp had actually designed this feature. So instead of relying on assumptions, I went through WhatsApp's official announcements and documentation on Communities, Announcement Replies, and Phone Number Privacy.
From the documentation, it was clear that Community members aren't supposed to see each other's phone numbers unless they're an admin or already have an existing conversation or contact relationship. That gave me a clear expectation of how the feature was intended to behave.
With that understanding in mind, I went back to my observations and that's when things started getting interesting.
- Sharing Our Vision for Communities on WhatsApp – https://about.fb.com/news/2022/04/our-vision-for-communities-on-whatsapp/
- New Ways to Organize Events in WhatsApp Communities – https://about.fb.com/news/2024/05/events-in-whatsapp-communities/
- WhatsApp is rolling out a phone number privacy feature for Communities – https://wabetainfo.com/whatsapp-is-rolling-out-a-phone-number-privacy-feature-for-communities/
The Discovery
After testing it over and over again, I finally understood what was happening.
What I initially thought was just a random inconsistency turned out to be much more than that. Under certain conditions, I was able to see information that, according to WhatsApp's privacy model, shouldn't have been visible.
The moment everything clicked was honestly satisfying. All the repeated testing, reading through the documentation, trying different Communities, and eliminating one possibility after another finally paid off.
At that point, I knew this wasn't just an interesting observation anymore. It was a privacy issue that deserved to be reported responsibly.
The Responsible Disclosure
After verifying my findings, I reported the issue to Meta through their Bug Bounty Program. To be honest, I'm not even sure if it falls within the program's scope, but I still felt it was worth reporting. If nothing else, I hope it helps improve the platform and gets patched if needed.
I've intentionally left out the steps to reproduce the issue because I still haven't received confirmation on whether it has been fixed. Until then, I'd rather prioritize user privacy and safety than share technical details that could potentially be misused.
Looking Back
I still find it funny that this whole thing started with a random click.
I wasn't testing WhatsApp or looking for bugs. I just noticed something that didn't make sense and kept following it until I finally understood what was happening.
Sometimes that's really all security research is being curious enough to not ignore the small things.
All thoughts, views and opinions expressed herein belong exclusively to the author.
