3 ms·
OK... but it's not phone number enumeration. You need to give it a phone number to check if whatsapp acc is registered for it. So you need to have a collection
by throwaway290 11mo ago
OK... but it's not phone number enumeration. You need to give it a phone number to check if whatsapp acc is registered for it. So you need to have a collection of phone numbers first. If you have a collection of all phone numebrs in the world then you could enumerate whatsapp accounts.
And yes the pictures were leaked in the process.
- hashhar 11mo agoIt's trivial to enumerate all the phone numbers in the world.
- throwaway290 11mo agoexactly. to claim enumerating phone numbers is a whatsapp bug is stupid. and to say profile pictures were not revealed = not reading tfa.
- yorwba 11mo ago"The accessible data items used in the study are the same that are public for anyone who knows a user's phone number and consist of: phone number, public keys, timestamps, and, if set to public, about text and profile picture." Source: TFA, which I read.
- throwaway290 11mo agoFrom my understanding the accessible data items meant they got them through the bug? Maybe I read wrong