Post #2819728

2026-05-24 21:48 UTC

On iOS and macOS, WhatsApp stores chat databases unencrypted in an app group container accessible to apps from the same developer. So all Meta apps on the same iPhone (e.g., Facebook) can read WA chats in plaintext without permission, and users wouldn't be notified. https://blog.cryptographyengineering.com/2026/02/02/whatsapp-encryption-a-lawsuit-and-a-lot-of-noise/ This is a demo we prepared recently to show a macOS bug that allowed unrestricted access to protected app containers. WhatsApp stores data at rest without encryption. https://m.youtube.com/watch?v=Naq5IojVoNs

Replies (6)

@mysk@mastodon.social 2026-05-25 03:42

This exchange from X adds some context: https://infosec.exchange/@psylo/116633092694513326

Open ##3245625
@erlenmayr@chaos.social 2026-05-24 22:27

@mysk@mastodon.social Are you sure it is from the same developer (technically, as in signed with the same developer key)? Whatsapp was in the store long before Facebook bought it.

Open ##3245626
@xs4me2@mastodon.social 2026-05-25 00:17

@mysk@mastodon.social Wtf…

Open ##3245628
@__ic@mastodon.social 2026-05-25 00:50

@mysk@mastodon.social Thanks for sharing. Would you have alternative sources? The post from Green is more nuanced than what it sounds here... just read and he basically says "maybe", with disclaimers. Also, the screenshot here shows access to 2024 data (did not check the video). No idea, but WA could hide behind a proclaimed small-scale bug fixed today.

Open ##3245631
@psylo@infosec.exchange 2026-05-25 03:29

@mysk@mastodon.social Interesting exchange on, dare I say it, X: 🧵 @wabetainfo@mastodon.social : This is misleading. While it is true that WhatsApp's database is not encrypted on the device, it is stored in a secure container that only the app can access. If there are system-level exploits that allow another app or process to access its contents, it is up to the operating system to fix them. The claim that other Meta apps can access the WhatsApp database is incorrect. The database is in a shared container to enable WhatsApp to easily migrate data to WhatsApp Business. Other Meta apps, such as Facebook and Instagram, cannot access this container. Specifically, containerURLForSecurityApplicationGroupIdentifier:@"http://group.net.whatsapp.WhatsApp.shared" returns NULL if called from Facebook, Instagram, Messenger, Edits, and other Meta apps. Only WhatsApp Business can access that container to migrate data to WhatsApp Messenger. Similarly, WhatsApp cannot access the containers of other Meta apps, such as those of Facebook (http://group.com.facebook.Facebook) and Instagram (http://group.com.burbn.instagram). However, Edits can access Instagram's shared container. As a result, WhatsApp's data is isolated within its own app group container. Cross-app access is not possible under normal system permissions

Open ##3245634
@jamesbooker@floss.social 2026-05-25 08:22

@mysk@mastodon.social so all those ads on the London Underground saying 'nobody can read your WhatsApp messages, not even WhatsApp' are a load of shit, because Meta can just exfiltrate then through the Facebook app instead?

Open ##3245642