whatsappPopular third-party chat app WhatsApp is leaving a "forensic trace" of every supposedly deleted chat log, meaning anyone with access to your smartphone -- or another device connected through the cloud -- could potentially access data from the app. The discovery comes from iOS researcher Jonathan Zdziarski, who shared the information in a blog post after discovering the potential security flaw in the latest version of WhatsApp (via The Verge).

Zdziarski tested out his theory by beginning a few chat threads, then archiving, clearing, and deleting them, but found that none of the app's deletion methods, even Clear All Chats, "made any difference in how deleted records were preserved." The central flaw appeared to be in the app's SQLite records, which retained the deleted chats in its database that could be accessed by a harmful individual with the right "popular forensics tools."

In his post, Zdziarski mentioned that the problem isn't unique to WhatsApp, and has even gone into detail about "forensic trace leakage" in Messages on iOS and OS X, and ways Apple could address such privacy issues, in a separate blog post. He explained succinctly that short-lived chats between friends and family using these apps are "not ephemeral on disk," which not only could be a cause for concern with users, but could allow law enforcement legal access to thought-to-be-deleted WhatsApp messages thanks to the lack of encrypted communication between WhatsApp and iCloud.

The core issue here is that ephemeral communication is not ephemeral on disk. This is a problem that Apple has struggled with as well, which I’ve explained and made design recommendations recently in this blog post.

Apple’s iMessage has this problem and it’s just as bad, if not worse. Your SMS.db is stored in an iCloud backup, but copies of it also exist on your iPad, your desktop, and anywhere else you receive iMessages. Deleted content also suffers the same fate.

All the same, Zdziarski caps his post by mentioning there's no reason for widespread panic to ignite because of the WhatsApp security flaw, mainly due to the fact that someone with malicious intent would need to jump through so many hoops to finally access the deleted messages. The iOS researcher stated that his purpose was for users to simply "be aware of WhatsApp’s footprint." He also gives a few options for users looking to mitigate the issue, including periodically deleting WhatsApp "to flush out the database," disabling iCloud backups, and avoiding the storage of backup passwords in Apple's keychain.

Earlier in the year, Apple reiterated its intent to double down on user privacy and safety within its iCloud platform. Currently, encrypted data saved in iCloud is accessible by Apple with a key, which grants it access to accounts for assistive purposes, like if someone forgets their password. However, with the steadily growing data amassing in users' iCloud accounts -- from texts to pictures and personal health data -- Apple is looking to provide end-to-end encryption in its cloud-based storage platform, meaning not even the company itself could gain access to the accounts of its users even if it wanted to.

Check out Zdziarski's blog post for more details on the issue.

Top Rated Comments

LordQ Avatar
68 months ago
Whatsapp is a Facebook-owned company so yeah, security flaw.

Score: 9 Votes (Like | Disagree)
fabiopigi Avatar
68 months ago
You know, the sad thing is, most commenters only read "WhatsApp, security flaw", but the problem is no spefici to Whatsapp, but the SQLite database.

Jonathan even wrote the same flaw exists in iMessage as well. But no... "it's facebook", "iMessage is better", "Don't trust facebook". Yeah there are valid arguments for all these claims, but this security leak is none of them.

Read the whole article at least before you foolishly bash another company.
Score: 7 Votes (Like | Disagree)
Oblivious.Robot Avatar
68 months ago
If only more people in my circle used Telegram over WhatsApp.

Even though I have to say, iMessage is still my favourite among the ones who own Apple devices, and I seem to talk to them more than the others. :D
Score: 3 Votes (Like | Disagree)
KALLT Avatar
68 months ago
It is just a systemic problem with databases in general. Programmers do not always contemplate or implement operations that remove entries from databases, sometimes because the data model is just not build that way. As a user, you almost never know how data is stored and how the application or websites handles deletion requests.

For real security, use open source. Signal or Telegram.
Avoid Telegram. Their encryption scheme is home-brewed and a few flaws have already been found, their server-side source code is closed-sourced and their company structure is dubious with a web of shell companies in jurisdictions that do not disclose full details. There is ample to find about Telegram that should make you sceptical, at least if you intend to use Telegram under the assumption that it offers ‘real security’.

Signal and Threema are definitely the more serious contenders.
Score: 2 Votes (Like | Disagree)
bushido Avatar
68 months ago
Whatsapp is a Facebook-owned company so yeah, security flaw.

"Zdziarski mentioned that the problem isn't unique to WhatsApp, and has even gone into detail about "forensic trace leakage" in Messages on iOS and OS X"
Score: 2 Votes (Like | Disagree)
Altis Avatar
68 months ago
You know, the sad thing is, most commenters only read "WhatsApp, security flaw", but the problem is no spefici to Whatsapp, but the SQLite database.

Jonathan even wrote the same flaw exists in iMessage as well. But no... "it's facebook", "iMessage is better", "Don't trust facebook". Yeah there are valid arguments for all these claims, but this security leak is none of them.

Read the whole article at least before you foolishly bash another company.
This particular security flaw isn't specific to Whatsapp, but Facebook owning Whatsapp should tell you what level of privacy and security to expect of it.

iMessage still requires an actual intrusion.
Score: 1 Votes (Like | Disagree)

Related Stories

studio buds family

Beats Studio Buds Debuting Today With Active Noise Cancellation, Stemless Design, and More for $150

Monday June 14, 2021 8:00 am PDT by
We've seen a lot of teasers about the Beats Studio Buds over the past month since they first showed up in Apple's beta software updates, and today they're finally official. The Beats Studio Buds are available to order today in red, white, and black ahead of a June 24 ship date, and they're priced at $149.99. The Studio Buds are the first Beats-branded earbuds to truly compete with AirPods...
YouTube Picture in Picture Feature

YouTube Premium Subscribers Can Now Use iOS Picture-in-Picture: Here's How

Wednesday August 25, 2021 3:55 am PDT by
Google has rolled out picture-in-picture support as an "experimental" feature for YouTube premium subscribers, allowing them to watch video in a small window when the app is closed. If you're a premium YouTube subscriber looking to try out picture-in-picture, follow these steps: Launch a web browser and sign into your YouTube account at YouTube.com. Navigate to www.youtube.com/new. Scroll...
M1X MBP Feature

Leaker: Upcoming MacBook Pro to See Price Hike Over Current Model, Equal Performance Across 14 and 16-Inch Sizes

Tuesday August 24, 2021 5:28 am PDT by
The upcoming 14-inch MacBook Pro is set to be more expensive than the current 13-inch MacBook Pro and both the 14 and 16-inch models will offer the same performance, according to the leaker known as "Dylandkt." The leaker shared the information on Twitter, explaining that both of the upcoming MacBook Pro models, expected to come in 14 and 16-inch sizes, will feature the same performance due...
youtube apple tv

YouTube Discontinuing 3rd-Generation Apple TV App, AirPlay Still Available

Wednesday February 3, 2021 3:09 pm PST by
YouTube is planning to stop supporting its YouTube app on the third-generation Apple TV models, where YouTube has long been available as a channel option. A 9to5Mac reader received a message about the upcoming app discontinuation, which is set to take place in March.Starting early March, the YouTube app will no longer be available on Apple TV (3rd generation). You can still watch YouTube on...
ryanscoolios13thumbnail

Apple Releases iOS 13.1.3 With Bug Fixes for Phone, Mail, Health, and More

Tuesday October 15, 2019 10:09 am PDT by
Apple today released iOS 13.1.3 and iPadOS 13.1.3, minor updates to the iOS 13.1.2 software that was released two weeks ago. This is the fourth update to the iOS 13 operating system that came out in September. The iOS and iPadOS 13.1.3 updates are available on all eligible devices over-the-air in the Settings app. To access the updates, go to Settings > General > Software Update....
Top Stories 75 Thumbnail

Top Stories: Last-Minute iPhone 13 Rumors, Apple Announces App Store Changes, and More

Saturday September 4, 2021 6:00 am PDT by
The finish line is in sight! Apple's annual iPhone event is likely just a week or so away and all eyes will be on the company as it unveils the next version of its most popular product line. With any luck, we'll also see the next-generation Apple Watch and perhaps even some new AirPods. Other news this week saw Apple making some more changes to its App Store policies in response to a...
affinity designer contour tool

Serif Updates Affinity Photo, Designer, and Publisher With New Tools and Functions

Thursday February 4, 2021 1:58 am PST by
Serif today announced across-the-board updates for its popular suite of Affinity creative apps, including Affinity Photo, Affinity Designer, and the Apple award-winning Affinity Publisher for Mac, all of which were among the first professional creative suites to be optimized for Apple's new M1 chip. "After another year which saw record numbers of people switching to Affinity, it's exciting to...
iPhone 13 Dummy Thumbnail 2

Kuo: iPhone 13 to Feature LEO Satellite Communications to Make Calls and Texts Without Cellular Coverage

Sunday August 29, 2021 7:39 am PDT by
The iPhone 13 will feature low earth orbit (LEO) satellite communication connectivity to allow users to make calls and send messages in areas without 4G or 5G coverage, according to the reliable analyst Ming-Chi Kuo. In a note to investors, seen by MacRumors, Kuo explained that the iPhone 13 lineup will feature hardware that is able to connect to LEO satellites. If enabled with the relevant...
maxresdefault

Craig Federighi and Greg Joswiak Discuss iPadOS 15, macOS Monterey, Privacy, Shortcuts on Mac, and More

Saturday June 12, 2021 6:12 am PDT by
As is tradition, Apple executives Craig Federighi and Greg Joswiak joined Daring Fireball's John Gruber in an episode of The Talk Show to discuss several announcements that Apple made over this weeks WWDC, including iPadOS 15, macOS Monterey, and a large focus around privacy. Federighi kicks off the conversation discussing the common architecture, now thanks to Apple silicon, across all of...
iOS 14 on iPhone feature emergency

Apple Seeds Third Betas of iOS and iPadOS 14.6 to Developers [Update: Public Beta Available]

Monday May 10, 2021 10:13 am PDT by
Apple today seeded the third betas of new iOS and iPadOS 14.6 updates to developers for testing purposes, one week after seeding the second iOS and iPadOS 14.6 updates. iOS and iPadOS 14.6 can be downloaded through the Apple Developer Center or over the air after the proper profile has been installed on an iPhone or iPad. iOS and iPadOS 14.6 appear to be more minor changes focusing on...