WhatsApp Security Vulnerabilities Exposed by Leaked Chats
Translated & summarized from Mako by baba
A leak of WhatsApp conversations attributed to Prime Minister's advisor Yonatan Urich has revealed security vulnerabilities beyond end-to-end encryption. Experts explain that connected services and exposed access keys can compromise accounts, as allegedly happened with Urich's monitoring tool. The leaks, which Urich is suing over, highlight risks from external service connections and rapid AI development. Users are advised to check linked devices, use two-step verification, and avoid sharing authentication codes to protect their accounts.
The story in 5 lines · by baba
- WhatsApp conversations attributed to PM's advisor Yonatan Urich were allegedly leaked due to external service connections, not encryption breaches.
- Security experts state end-to-end encryption protects messages in transit but not on connected devices or services.
- Exposed access keys in quickly developed AI tools pose a significant risk, according to cybersecurity firms.
- Vulnerabilities include open linked devices, sharing authentication codes, and phishing or malware attacks.
- Users are urged to review linked devices, enable two-step verification, and limit third-party connections.
A recent leak of WhatsApp conversations attributed to Prime Minister's advisor Yonatan Urich has highlighted significant security vulnerabilities in the messaging app, despite its end-to-end encryption. The leaked messages, initially published on pirate websites and later shared via an Excel file, were allegedly linked to Urich's work developing an AI-powered communication monitoring tool for the Prime Minister. The tool scanned news sources and sent alerts to WhatsApp groups, and its code, which was reportedly left exposed online, contained identifiers and access keys to these groups. Urich has filed a lawsuit against individuals who shared the conversations.
Security experts explain that while WhatsApp's end-to-end encryption protects messages during transit, it does not safeguard information once it reaches a device or a connected service. Moshe Levy, co-founder and CTO at Levinity Cyber, stated that any "linked device" or authorized service, such as a work computer or an automation service, can view messages in plain text. He emphasized that the encryption was not broken; rather, a "door was left open" through the connection of external services to sensitive accounts.
Shai Nachum, CEO of CYGHT, pointed to the risks associated with rapid development using AI tools, especially for services connecting to WhatsApp. He warned that quickly generated code might contain security flaws, and access keys could be stored improperly or accidentally uploaded to public repositories, making them accessible to attackers. Nadav Avital, AI & Application Security Field CTO at Imperva-Thales, cited security weaknesses found in AI development platforms like n8n and Dify, which could allow account takeovers and exposure of access keys. His company's research also found that nearly 40% of analyzed APIs suffer from authentication and token management security risks.
Ron Strauber, VP of Product at Spikerz Security, identified three primary risk areas: an open linked device, providing authentication codes to external services, and falling victim to phishing or malware. He noted that the alleged leak stemmed from Urich connecting his personal WhatsApp to an external service granting full access to conversations, a pattern becoming more common with new market tools. Experts advise users to regularly check linked devices in WhatsApp settings, disconnect unknown or unnecessary connections, avoid linking personal accounts to unfamiliar third-party services or AI tools, and enable two-step verification with a PIN. Developers are urged to avoid storing API keys and tokens in code or public repositories and to revoke and reissue keys if exposure is suspected.
Mentioned
The same event, reported separately by each outlet. Open a few to compare what different newsrooms emphasize — and what they leave out.
Left 1Centre 1
Not the same event — other stories that share this one’s people, places, or theme: background, reactions, and follow-ups.
