Hey there! You are using WhatsApp: Enumerating Three Billion Accounts for Security and Privacy

Hey there! You are using WhatsApp: Enumerating Three Billion Accounts for Security and Privacy

Speakers: Gabriel K. Gegenhuber

Conference: NDSS Symposium

YouTube: https://www.youtube.com/watch?v=xJSHGfp8PIs

Overview

Gabriel K. Gegenhuber presents a staggering empirical study: the researchers enumerated 3.5 billion active WhatsApp accounts -- a substantial share of the world's population -- by querying 63 billion candidate phone numbers in less than one month. WhatsApp's internal APIs had essentially no rate limiting, allowing the researchers to crawl 500 million accounts from the 2021 Facebook data leak in just 5 hours and the entire US numbering plan (3 billion mobile numbers) in one day. Beyond presence information, they extracted operating system data (80% Android, 20% iOS globally), profile picture availability, profile picture timestamps, and encryption key material -- discovering approximately 3 million accounts with non-unique public keys, indicative of scammer operations using faulty third-party clients. The study also validated that 58% of phone numbers from the 2019 Facebook scraping incident remained active over 6 years later. WhatsApp took approximately one year to respond and ultimately deployed rate limiting and cardinality checks in October 2025.

Background

▶ Watch: WhatsApp: world's largest messenger, updated to 3 billion users (0:30)

WhatsApp is the world's largest messenger, with over 3 billion users (upgraded from 2 billion during the study). It functions as near-public infrastructure for personal and business communication in many countries. Like all instant messengers, WhatsApp requires a contact discovery mechanism for users to find peers on the platform, inherently creating an enumeration attack surface.

Previous work at NDSS five years prior demonstrated enumeration via UI automation (Android emulators with Selenium), achieving roughly 16,000 queries per day and 15 million numbers total. Since then, open-source projects like Whatsmeow and Baileys have reverse-engineered WhatsApp Web, enabling direct API access via individual XMPP queries. The researchers discovered during prior work on instant messenger fingerprinting that these API endpoints had no rate limiting, and their responsible disclosure to WhatsApp received no response for three months, prompting the enumeration study.

Google's libphonenumber library, designed for phone number validation, was repurposed as a phone number generator for 245 countries, producing 63 billion valid candidate numbers after post-processing.

Key Findings

▶ Watch: 500 million accounts crawled in 5 hours, US numbering plan in 1 day (4:00)

3.5 billion accounts enumerated: The researchers discovered 3.5 billion active WhatsApp accounts across 245 countries in less than one month of querying, from a starting pool of 63 billion candidate phone numbers.

Zero effective rate limiting: 500 million accounts from the Facebook leak were enumerable in 5 hours. The entire US numbering plan (3 billion mobile numbers) was completed in one day. All experiments ran from a single university server with no disguising or distributed infrastructure.

Data leak persistence: 58% of phone numbers from the 2019 Facebook scraping incident were still actively used on WhatsApp over 6 years later, demonstrating that data leaks have effectively permanent consequences.

Operating system leakage: Artifacts in the end-to-end encryption public key bundle revealed the operating system of each account. Globally: 80% Android, 20% iOS. Country-level variations were significant -- India at 95% Android, the US at approximately 30% Android / 70% iOS.

Key collision anomaly: Approximately 3 million accounts had non-unique public keys, with the most frequent key used over 100 times. Concentrated in countries like Myanmar, Indonesia, and Nigeria, these appeared to be scammer operations using third-party client implementations with faulty cryptographic implementations (e.g., all-zero private keys).

Profile picture mass download: Large-scale retrieval of public profile pictures was possible with no effective rate limiting. Combined with facial recognition, this enables building a reverse phone book mapping faces to phone numbers.

WhatsApp banned countries: In countries where WhatsApp is banned, millions of active users were discovered (60 million in Iran despite the ban). In North Korea, exactly 5 active users were found.

Technical Deep Dive

▶ Watch: 58% of 2019 Facebook leak numbers still active 6 years later (8:00)

The enumeration used direct XMPP queries via reverse-engineered WhatsApp Web APIs, bypassing the UI automation approach of prior work. Two API vectors were exploited: the phone book sync endpoint (traditional contact discovery) and a profile picture retrieval endpoint (intended for fetching contact photos, repurposed for presence checking). Neither endpoint enforced meaningful rate limits.

The phone number generation leveraged libphonenumber's internal structure knowledge -- number length, area code patterns, mobile prefix formats -- to generate only structurally valid candidates rather than brute-forcing all 10^15 possible international numbers. This reduced the search space from 1 quadrillion to 63 billion feasible numbers.

The operating system identification exploited a subtle artifact: the format of the public key identity bundle in WhatsApp's end-to-end encryption implementation differs between Android and iOS clients. This metadata is accessible to anyone who can query an account's encryption keys, which the enumeration API allowed.

The key collision analysis identified accounts sharing identical public keys -- a cryptographic anomaly indicating either a shared key generation seed or a deterministic key derivation flaw. The geographic clustering (Myanmar, Indonesia, Nigeria) and the appearance of all-zero private keys pointed to scammer networks using poorly implemented third-party WhatsApp clients that failed to generate unique cryptographic material.

Profile picture timestamps (when last updated) and "about" text timestamps provided additional metadata, enabling identification of dormant accounts (profile pictures set 10+ years ago) and recently active accounts.

Demo / Proof of Concept

▶ Watch: 3 million accounts with non-unique public keys: scammer networks (10:00)

The study was conducted entirely from a single university server with no attempt to disguise the source. The abuse email address was configured and reachable, but no contact was received during the enumeration. The researchers crawled the 2021 Facebook data leak (500 million numbers, 5 hours), the US numbering plan (3 billion numbers, 1 day), and all 245 supported countries (63 billion numbers, less than one month). Over 90% of discovered accounts showed encryption key material updated within the last month, confirming active use.

Defensive Implications

▶ Watch: Systemic risk: centralization of 3.5 billion users in one platform (14:00)

The study exposes catastrophic failures in WhatsApp's abuse prevention for a platform serving 3.5 billion users. The eventual fix (deployed October 2025 after approximately one year of engagement) included rate limiting and cardinality checks (tracking the number of unique accounts each user interacts with over time, breaking the circuit if it exceeds thresholds).

The broader implications are systemic. The centralization of messaging means a vulnerability in one platform affects billions rather than thousands. Proprietary platforms operate as black boxes that cannot be independently audited. Phone numbers as identifiers have insufficient entropy for privacy -- they are predictable, enumerable, and permanent. Combined datasets (WhatsApp OS data + Facebook leak employee data) enable highly targeted phishing and scam campaigns. Profile picture mass download combined with facial recognition creates an unprecedented reverse phone book capability.

Key Takeaways

• 3.5 billion WhatsApp accounts were enumerable from a single server in under one month with zero detection
• WhatsApp's APIs had essentially no rate limiting on contact discovery and profile picture retrieval endpoints
• 58% of phone numbers from the 2019 Facebook scraping incident remain active 6+ years later -- data leaks are permanent
• Operating system identification (80% Android/20% iOS globally) was possible through encryption key bundle artifacts
• Approximately 3 million accounts had non-unique public keys, indicating scammer networks using faulty third-party clients
• WhatsApp took one year to deploy countermeasures (rate limiting, cardinality checks) after the initial report was "mistriaged"
• The centralization of messaging into a single proprietary platform serving billions creates systemic risk with no independent audit capability

About the Speaker(s)

Gabriel K. Gegenhuber is a researcher whose work focuses on large-scale empirical security and privacy evaluations of messaging platforms. The research was conducted from a university setting with full responsible disclosure to WhatsApp/Meta, including assisting in developing and testing countermeasures over the course of approximately one year of engagement.