WhatsApp could ensure that an app on a device with 2FA registered can prevent this issue, using 2FA as a circuit breaker. This isn’t complex and should be easily fixed. And this should not work when 2FA is enabled, as was the case on this “victim’s” app. There are many reasons why it might be advantageous to block someone from their go-to messenger. There is no sophistication to this attack-that’s the real issue here and WhatsApp should address it immediately. Remember, they see the same timer as you.Ĭlearly, the combination of this verification architecture, the SMS/code limits and the automated, keyword-based actions triggered by incoming emails is open to abuse. You will need to contact WhatsApp and try to find someone who can help.Įven if the attacker deactivates your phone during the first cycle, they can push you into a second 12-hour countdown if they request and enter codes at the expiration of the first countdown before you get chance. “It’s too late,” the researchers told me. Verification countdown errors on both Attacker's and Victim's Phone After 3rd Attack Cycle WhatsApp / Androidīut unfortunately, your phone is treated the same way as the attacker’s-and so, if the attacker waits until now before emailing WhatsApp Support to deactivate your number, there will be no way for you to reregister WhatsApp on your phone when you are kicked out of your app.

Sudden attack hack