The WhatsApp* messenger has turned out to be extremely “leaky.”
Cybersecurity expert Elorm Daniel stated that messages in the WhatsApp* messenger contain user geolocation data even without their consent. The specialist published the results of a forensic technical examination conducted on an iPhone 12, which established that the metadata of correspondence automatically records the location of the conversants.
According to Daniel, the phone saves location coordinates without users requesting it. This implies that with geolocation enabled, any forensic analysis of the device during communication can reveal the precise geographical coordinates of the participants in the exchange.
The expert emphasized that the collected data isn’t limited to location information—the metadata retains details about the creator of a group chat, its creation time, participants who joined or left the conversation, and this information remains accessible even after a user leaves the group.
“Every application leaves traces. Every message carries more data than just text. This analysis proves that investigators can access locations, passwords, group information, message history, and application activity without even jailbreaking,” he added.
Daniel also pointed out that every media file—be it a photo, video, voice recording, or screenshot—automatically receives the exact GPS coordinates of where it was created. This allows for establishing the geography of the device owner’s digital activity. Furthermore, the phone’s memory stores URL addresses, credentials, passwords, and a complete history of installed applications, building a detailed digital profile of the user.
Consequently, beyond intelligence agencies, malicious actors can also obtain data regarding a person’s whereabouts. Moreover, the mere fact that Western intelligence agencies can literally see everything within the messenger does not enhance its reputation.
Interestingly, Meta** declined to comment on the messenger’s “vulnerability.” In response to an inquiry from the Turkish publication “Anadolu,” the company merely stated that “there are additional features whose use requires the collection of supplementary information.”
About the Author
