A disclaimer is in order. The information mentioned in this article is for educational and awareness purposes only. The author will not be held responsible for any misuse of this information.
A few weeks ago, we conducted research on the relationship, or lack thereof, between telecom providers and online messaging services like WhatsApp or Signal. Our aim was to investigate whether there are any implications for the use of these services after discontinuing a mobile number registered with them.
We found that there is no direct link between telecom providers and messaging services, posing a significant issue. Why is this problematic? Why does it warrant a blog post or video? Let’s delve into it.
Problem: The issue arises when users discontinue a specific number but fail to de-register it from the messaging service. Here’s the scenario: when registering with, say, WhatsApp, the application typically requires a phone number, which then receives a one-time password (OTP). Once the registration process is complete, the user may remove the SIM card, cancel their subscription with the telecom provider, and seemingly move on. However, here’s the catch, the user can continue using the messaging service, oblivious to the fact that their old number may have been assigned to a new subscriber. The real dilemma surfaces when attempting to re-register with WhatsApp, where complications may arise.
However, there is a workaround to retain the “Shadow Number.” By registering with multiple online services that verify via phone numbers, the new telecom subscriber can regain access to WhatsApp, albeit possibly losing access to other services like Signal. Now, if you happen to be a threat actor, this situation presents an opportunity. With access to a “shadow number,” you can message anyone and impersonate anyone. Even if the number is traced, it’ll be linked to the new subscriber.
Advantages: Despite the risks, these shadow numbers offer anonymity and privacy. Whether you’re a journalist in a hostile country, a whistleblower, a threatened spouse, or someone in witness protection, these shadow numbers can prove invaluable.
In conclusion, it is important to recognize that messages sent from WhatsApp numbers cannot be easily traced. Understanding this fact is crucial in identifying and mitigating smishing attacks across platforms like WhatsApp and Signal. We encourage readers to remain vigilant and take appropriate measures to protect their privacy and security online.