“While we appreciate this researcher’s report and value the time he took to share it with us, it did not qualify for a bounty since it merely contained a search engine index of URLs that WhatsApp users chose to make public,” said a WhatsApp spokesperson. The application was dismissed, however, on the grounds that WhatsApp users have full oversight of the information attached to their profile that is made publicly available. Having made the discovery on May 23, Jayaram subsequently reported the issue to WhatsApp owner Facebook through its bug-bounty scheme. Clicking through to the web page does not uncover the user’s full name, but does reveal their WhatsApp profile picture.
Scouring the domain via Google searches, Jayaram reportedly uncovered 300,000 WhatsApp numbers made public via this mechanism.
0 kommentar(er)
