Netanyahu Aide's WhatsApp Chats Leaked After Security Lapses

WhatsApp conversations attributed to Yonatan Urich, a close advisor to Prime Minister Benjamin Netanyahu, were published online Sunday via a specially created website. The leak included thousands of messages and a contact list, with the website's operators promising further releases. The published exchanges date back to September 24, the same day it was revealed that Urich had left software code containing sensitive WhatsApp access credentials exposed online.

While the timing raises questions, there is no evidence directly linking the code exposure to the leak. However, in the weeks prior, two significant security vulnerabilities in a system Urich developed were uncovered. This system, built using the AI tool Claude, was designed to monitor media for publications concerning the Prime Minister, his wife, and political rivals, sending alerts to dedicated WhatsApp groups. Urich had inadvertently left the system's code publicly accessible on GitHub, a platform for developers. This exposed not only the code but also WhatsApp group identifiers and digital access keys, known as tokens.

These tokens could potentially allow unauthorized access to group member information, message retrieval, and even message sending through the system, without needing to breach WhatsApp's encryption itself. Following an inquiry by Haaretz, access to the code was restricted, but copies may have already been obtained by others. A separate investigation by Calcalist revealed that Urich had connected his personal WhatsApp account to a third-party service called UltraMsg, which allows automated reading and sending of messages. This connection, made via QR code scanning, granted the service broad permissions, including access to decrypted messages from Urich's private account. UltraMsg reportedly operates from the UAE, and its terms of service allow for data retention and sharing, though there is no evidence Urich's specific conversations were shared.

The leaked conversations include exchanges with figures like Topaz Lok, Yaakov Bardugo, and Amit Segal, as well as contact information for members of the Netanyahu family, though their conversations were not initially published. Urich, through his attorneys, stated that an unauthorized party had breached his WhatsApp account, published personal conversations, and potentially altered them. His legal team warned of potential lawsuits against those involved in the publication and dissemination of the material. The exact method of the leak remains unknown, and it is unproven whether the exposed access keys were exploited. The incident highlights two separate security risks: the exposure of access keys and the connection of a personal WhatsApp account to a service with extensive permissions, leaving the system intended to gather information for the Prime Minister's office as itself a source of exposed sensitive data.