We really did not know anything about this feature, but it seems quite dangerous that a person could know by which IP address another person is connecting to WhatsApp.As we have mentioned in other notes of Geek Data, WhatsApp is still one of the most insecure IM clients and has certain problems in terms of security. Today we are going to show you another security flaw seeing the interest that readers have in the security of this instant messaging
The study of this failure was published by Luis Delgado and Ferran Pichel in Security By Default, not only to take advantage of this feature in order to locate the IP address of a person, but as a security failure that caused a Denial of Service in the app, besides being able to generate an uncontrolled consumption of resources.The problem of security is that by default in the new versions of WhtasApp for Android (iPhone is introducing that feature), the application shows a preview image of any URL that has been sent as a chat message on WhatsApp.
The functionality of displaying a thumbnail preview of an image of the shared web address is common in any social network in which it is allowed to publish URLs, such as Facebook or Twitter, and that is why they must have introduced it. The detail however is subtle as Chema mentions, and completely changes the scenario, since in Facebook or Google+ the image is downloaded from the social network when viewed by a client, but by making this default in a mobile client Security risks are equivalent to when a remote image is downloaded by default in an email.
By sending a URL from a website that has an image that is included from a controlled web server, forces the WhatsApp client for Android to make a request to the web server to download the image.In that request you can see the IP address from which the WhatsApp client for Android, that is, the mobile of the person behind a phone number, is connecting. The geographical location of the IP addresses are not 100% accurate and sometimes disparate things may happen, but it poses a risk to the privacy of a person in many cases in which it is possible to geo-position the address more or less correctly. IP.
In addition to that, the USER-AGENT is also in the petition, where many details of the software that is running after a certain phone number are given, which in a targeted attack scheme can be important, especially today they are known bugs for Android terminals not updated. Do not forget that users of Android terminals, due to the dispersion of hardware, are the least updated have the operating system, so they are the most exposed to known exploits.
If you have WhatsApp for Android it is best that you deactivate this option, which contributes rather little for your security and privacy. Also, as a general precaution try not to follow links you receive by WhatsApp messages, because even if you do not automatically upload the images, if you click on a link that you receive by WhatsApp and take you to a controlled web server, you will Make your IP address public, and the same thing will happen.