WhatsApp groups are showing up on Google search yet again. As a result, anyone could discover and join a private WhatsApp group by simply searching on Google. This was first discovered in 2019, and was apparently fixed last year after becoming public. Another old issue, which also appeared to have been fixed but seems to be cropping up again, is user profiles showing up through search results. People’s phone numbers and profile pictures could be surfaced through a simple a Google search, because of the issue.
By allowing the indexing of group chat invites, WhatsApp is making several private groups available across the Web as their links can be accessed by anyone using a simple search query on Google — although we are not sharing the exact details, this was verified by Gadgets 360. Someone who finds these links can join the groups and would also be able to see the participants and their phone numbers alongside the posts being shared within those groups.
Update: WhatsApp replied to say, “Since March 2020, WhatsApp has included the ‘noindex’ tag on all deep link pages which, according to Google, will exclude them from indexing.” Gadgets 360 was able to confirm that the search results are no longer visible on Google anymore; however, WhatsApp’s statement did not mention this fix. The full statement is at the end of this story. Rajshekhar Rajaharia, who informed about the indexing issue, commented on the statement given by WhatsApp and said, “Adding the ‘noindex’ tag is not a proper solution as links surface again on search results in a a few months. Big tech companies like WhatsApp should look for a proper solution if they really care users’ privacy.”
Cybersecurity researcher Rajshekhar Rajaharia informed Gadgets 360 about the indexing of WhatsApp group chat invites on Google. The indexing seems to have started again quite recently. At the time of writing, there were over 1,500 group invite links available in search results.
Some of the links indexed by Google lead to WhatsApp groups sharing porn. In a few other cases, there were links to WhatsApp groups dedicated to specific community or interest. Gadgets 360 also found groups sharing messages for Bangla and Marathi users. With the links, people who weren’t invited could easily join the groups.
This isn’t the first time that this issue has happened. In November 2019, WhatsApp group chat invites were initially found on Google search results. The issue was reported to Facebook by a security researcher, though it was resolved soon after it was covered by several news outlets in February last year.
Reverse engineer Jane Manchun Wong reported that WhatsApp had apparently fixed group chat indexing by adding the ‘noindex’ meta tag on the chat invite links. However, the fresh links do include the noindex meta tag.
