Last week Brazilian news outlets reported a scam involving WhatsApp where an attacker could get access to an WhatsApp account by activating the target phone number on a different device in control of a scammer. A detailed report is available here (Portuguese link). The scam works as follow:
- An employer of the carrier where the target phone number belongs would activates this same number on a different device, in possession of the scammer.
- The scammer then activates the WhatsApp account of the victim on this new phone, since it can now capture the SMS used to validate if a given device is in control of a given number.
- The scammer contacts the victim's family and friends, pretending to be in need of money, asking for transfer, this sort of thing.
Of course there are many flaws in the plan, since the original owner of the phone would notice his device no longer works, and some scammers have been caught already. It also needs the cooperation of a rogue carrier employee. Also with the new WhatsApp feature of two-step authentication, this attack can be prevented for 7 days.
However, all the news outlets have reported that the scammers had access to the following data:
- Groups
- Contacts
- Chats history
The first two items seem reasonable to me, what seems strange is how scammers could have access to the chat history, since we know WhatsApp only stores undelivered encrypted messages. This must mean that the scammer is getting the history from the Google Drive backup. However, the scammer only has the power to get hold of the phone number, how can he get access to the conversation files on Google just by controlling this?
I think it's really unlikely for this to be true, because my Google Account is protected by a password and extra check via two-step authentication, which the scammer does not have. Is this story not being reported accurately?