A critical issue might have exposed your WhatsApp or Telegram group to the public. As discovered by a researcher, many WhatsApp and Telegram Group invite links appeared on various search engines. Not only has this exposed legit private groups but also some illegal groups.
WhatsApp Telegram Group Invite Links Exposed
Researcher Jordan Wildon discovered that many search engines have indexed various messenger apps’ group invite links. With the search engines showing up WhatsApp and Telegram group invite links publicly. This includes visibility of the links on all major search engines such as Google, Yahoo, Bing, and Yandex.
Wildon revealed his findings via a tweet.
He further elaborated that this public exposure of the links not only allowed unwanted people to join such groups. Rather it also empowered potential attackers to find other active chats via brute forcing.
What’s worrisome is that another researcher had already found and reported this issue to Facebook authorities earlier. However, at that time, they expressed their inability to address this matter.
I reported to facebook in early november pic.twitter.com/QB7pHsz5vu
— HackrzVijay ? (@hackrzvijay) February 21, 2020
This flaw not only ruined the privacy of private WhatsApp and Telegram groups but also made many illegal groups publicly accessible.
The same could also allow data mining since an adversary could directly access phone numbers after joining the groups. Because of this issue, around 450,000 groups were exposed online.
Google Addressed The Matter, But…
Recently, WhatsApp has seemingly rectified the issue by removing the group invite link listings from Google. They also added a ‘noindex’ meta tag to prevent recurrent indexing in the future.
Looks like WhatsApp has fixed it by removing the existing listing from Google and adding the `noindex` meta tag on the chat invitation links! 😀 pic.twitter.com/kict2bsENu
— Jane Manchun Wong (@wongmjane) February 22, 2020
Google has also addressed the issue by removing all WhatsApp group links from indexing. However, other search engines are yet to follow.
Nonetheless, Wildon has shared a quick way for Group admins to mitigate the problem. He recommends resetting the group invite link.
UPDATE: This has been fixed on Google, but results are still available elsewhere.
If you’re concerned, I’d recommend going into group settings, tapping “Invite to Group via Link” then “Reset link”.
This doesn’t turn the link off, it generates a new one.https://t.co/snIwXAweJL pic.twitter.com/OZOZBeG8ak
— Jordan Wildon (@JordanWildon) February 23, 2020
While the matter seems partially resolved for WhatsApp, Telegram groups’ links may still appear in search engine results. Thus, until complete rectification of the matter, WhatsApp and Telegram group admins need to remain vigilant about incoming members.
Let us know your thoughts in the comments.