There is a world full of busybodies and nosy people, jealous boyfriends and squeamish parents who would make up fake papers to find out what their loved ones are doing, who they spend time with and what they talk about when they are in the company of friends . I haven't discovered anything new, have I? I figured. But, you know, after reading another email in which a person asked me how to spy WhatsApp for free I couldn't help myself: I had to post this little "vent"!
Now, however, let's try to get back into the ranks and take this opportunity to do something good, which is to know more closely what techniques are the most used by WhatsApp "spies" and how to protect yourself from them.
Fortunately, the messaging system created by Jan Koum and Brian Acton is no longer as vulnerable as it used to be, its protection systems have been greatly strengthened in recent months, but woe betide letting your guard down! There are still numerous tactics that attackers can put into practice to pounce on our smartphones and spy on our conversations, so let's try to understand how to discover them and, above all, how to prevent someone from using them to hit our accounts. In the end, it's less difficult than you imagine.
Identity theft
Identity theft is one of the risks you should be most wary of. It is a technique by which an intentional person can "cheat" WhatsApp by impersonating another person and access, without permission, the latter's conversations.
WhatsApp web
Believe it or not even web WhatsApp, the official service for accessing WhatsApp from your PC, can be used for identity theft. The fault lies with the Stay Connected feature, which allows the browser to store the user's identity and access conversations without requiring a rescan of the QR code.
In short, if an attacker manages to get hold of your smartphone (any excuse is enough, for example the need to make an urgent call) can activate the web version of WhatsApp on any laptop, tablet or smartphone and have access to all. your conversations without you noticing; an access that will be continuous and not temporary since WhatsApp Web works even when the cell phone is not connected to the same wireless network as the computer (provided it has an active Internet connection, no matter what).
However, in case the device owner has set up biometric recognition protections, such as unlocking the device via face or fingerprint, this solution is not feasible, since, at the time of WhatsApp Web activation, you are prompted to confirm the operation by the device owner's intervention.
The same argument would also apply to the official WhatsApp client for Windows and macOS, but in that case the procedure to follow for the attacker would be unnecessarily longer (as he would first have to install the software on his PC).
MAC address cloning
Another technique that can be used to spy on WhatsApp for free is MAC Address Cloning. what is it about? I'll explain it to you right away. The MAC address is a 12-digit code that uniquely identifies all devices capable of connecting to the Internet. It is also used by WhatsApp to verify the identity of users (along with the phone number) but with ad hoc applications it is possible to disguise it and fool the application.
If an attacker installs some of these applications on your cell phone (e.g. BusyBox and Phantom Mac Address for Android and SpoofMAC on iPhone) and manages to find out the MAC address of your smartphone (just go to the Info Settings screen) he can install a "cloned" version of WhatsApp and access your conversations.
Fortunately, this is not a very common practice, it requires some technical preparation and a lot of time to spend "in the company" of the victim's phone, at first to find out the MAC address of the device and then to read the confirmation SMS. necessary to activate the "cloned" copy of WhatsApp on the other smartphone; in any case, knowing its existence will help you avoid possible intrusions on your account.
How to defend yourself against identity theft
As we have just seen, most techniques for identity theft on WhatsApp involve physical access to the victim's phone. This means that to protect yourself you just need to follow some simple, but fundamental, common sense rules.
- Use a secure PIN - The number 1 rule to follow to prevent someone from poking their nose into our smartphones is to set a secure PIN on the lock screen. Here's how on Android and iOS.
- Android: go to Settings> Security> Screen lock> PIN. Alternatively, you can also set a gesture instead of the numeric PIN by going to Settings> Security> Screen Lock> Sequence.
- iPhone: go to Settings menu> Touch ID & Passcode> Change Passcode.
- Disable SMS display on the lock screen - Another trick I advise you to put into practice is the one about disabling SMS on the lock screen. This way, if an attacker tries to activate a "cloned" copy of WhatsApp using your phone number, he will not be able to see the verification code needed for it to work since no message will appear on the smartphone's lock screen (and the access to the phone will be blocked by the PIN) [1]. Here is how to proceed.
- Android: go to Settings menu> Security> Screen Lock> PIN, set a PIN and choose to hide only sensitive content.
- iPhone: go to Settings menu> Notifications> Messages and remove the check mark from the Show option under "Lock Screen".
- Check your WhatsApp web sessions - by going to the Settings> WhatsApp Web WhatsApp menu, you can check all active WhatsApp Web sessions for your account. If you notice any suspicious activity, press the Disconnect button on all computers and the "spies" will no longer be able to access WhatsApp Web using your account (they must scan the QR code again with their smartphone to do this). Perform this "verification" from time to time and you will avoid any identity theft through the Web version of WhatsApp.
- Use a secure password for your cloud accounts - now many apps, including WhatsApp, sync their data with the cloud (Android uses Google's cloud systems and iPhones, Apple's iCloud platform). So if someone managed to discover the password to access your cloud accounts, they could easily access your data and, with some tricks, even WhatsApp backups (which would in any case be unreadable without decryption, but better to prevent this from happening. ).
- Be careful who uses your smartphone - the most trivial tip, but probably the most important of all. If you want to keep your WhatsApp account safe, avoid lending your phone to strangers, check what your acquaintances / friends do with your phone and don't leave your smartphone unattended in public places.
Apps to spy on cell phones
As I also explained to you in my post about apps to spy on Android phones, there are numerous programs that allow you to monitor, control and locate smartphones remotely. Many of them are completely free and have the ability to hide themselves, that is, they do not appear on the home screen of the phone or on the screen with the list of all the applications installed on the device.
How to defend against spy apps
The installation of spy apps also requires physical access to the victim's cell phone, so I recommend that you follow the tips I gave you above and keep your phone under control at all times. Also, you could take a look at the list of apps installed on your smartphone and see if there is anything suspicious.
- Android: to see the full list of apps installed on Android, go to the Settings> Apps menu and select the All tab.
- An iPhone from version Four S to see the list of installed applications on an iPhone, go to the Settings menu> General> Use space and iCloud> Manage space.
Another clue that, on Android, can signal the presence of spy apps on the system is the addition of new applications to the list of device administrators. Then go to the settings of your smartphone, "tap" on the Security icon and select the Device Administrators item in the screen that opens. At this point, verify that in the list of applications that manage Android there are no "suspicious" applications. Otherwise, remove the check mark from the suspicious application and uninstall it by searching for it in the list of Android applications.
If you have a jailbroken IPhoneinstead, you can try to "unmask" the spy apps by typing the code * 12345 in the dialer or trying to connect to addresses localhost: 8888 and localhost: 4444 from the browser. If there are spy apps installed on the device, it is likely that in one of these ways you can access its admin panel and then disable them. I also advise you to open Cydia and to check carefully the list of all the packages installed on your device: if you notice some of them that could be traced to apps to spy on iPhone, remove them.
Are you worried that someone has installed a spy app on your smartphone but you can't see it? In cases like these, I'm sorry, but the only viable solution to dispel any doubts is to format the phone by deleting all apps and data. If you want to know how, check out my tutorials on how to reset iPhone and how to format Android.
Wireless network monitoring
Many people have asked me if it is possible to spy WhatsApp for free with applications, such as the very famous Wireshark, that allow you to monitor all data passing through a wireless network. The answer is no, at least not anymore.
In fact, at the end of 2014 WhatsApp started adopting an end-to-end encryption system which makes messages unreadable to everyone except legitimate senders and recipients. Even on WhatsApp's servers, messages arrive in encrypted form. The system, called TextSecure, involves the use of a pair of keys: a public one that is shared with the interlocutor and allows you to encrypt outgoing messages and a private one that resides on your smartphone and allows you to decrypt incoming messages.
That said, it should be remembered that WhatsApp is a closed source application, so it is not possible to thoroughly examine its source code and therefore it is not possible to know if there were errors in the implementation of end-to-end encryption ( errors that could clearly compromise its effectiveness).
Moral: WhatsApp is reasonably safe from Wi-Fi network monitoring (so-called "sniffing"), but woe betide letting your guard down! Therefore, avoid connecting to public Wi-Fi networks and be sure to always use the most updated and therefore most secure version of the application.
- It should be noted that without the prior cloning of the MAC address, it is impossible to spy on WhatsApp. The service, in fact, allows you to associate each phone number with a single smartphone and, therefore, the legitimate owner of the account would only need to reactivate his copy of WhatsApp to remove spies. ︎
