InfoSecBulletin Cybersecurity for mankind
The Indian government issued a notice WhatsApp planned to roll out its new ‘username’ feature. They are worried about fake accounts and fraud. The company must discuss the issue before moving forward.
This week, WhatsApp said it will let users pick a username and hide their phone numbers when they first contact someone. Users can choose a unique name for their WhatsApp account. Others can use this name to message or call them without seeing their phone number.
AI Finds Nation-State-Level Zoom Flaw in Under 24 Hours, Zero-Click Attack Exposed
Hacker Actively Exploit SonicWall and SharePoint Flaws
Gunra Ransomware Leverage Fortinet VPN Flaws to Evade MFA Obtaining Enterprise Data
Hackers accessed a US defense manufacturer’s Microsoft 365 account via phishing.
Google Play Apps Utilize Stealth Loaders to Spread Anatsa Banking Malware
Bangladeshi org listed “the Gentlemen’ ransomware victim list: CIRT warns
Around 800 Malicious npm Packages Distribute Cross-Platform RAT and Infostealer
Google Chrome 151 Update Fixes 41 Flaws, 6 Critical
Swiss gov.t SharePoint incident compromised 200 accounts
Azad president, Secretary Post Heads to Contest: ISACA Dhaka Chapter Election
Senior government officials said the Union Ministry of Home Affairs raised concerns with the Ministry of Electronics and IT. They said the government would undertake a risk assessment of the new feature, and see if it falls foul of the current legal architecture.
The government wants Meta to provide a full explanation of the username feature in three days. They also told the company not to launch the feature until discussions are finished, an official said.
“As we understand now, there is a possibility that bad actors may claim usernames, or close-enough variations related to prominent personalities, institutions, and organizations, and message other users while pretending to be someone they are not. For those who may not be technologically aware to make out the difference, it could be a huge challenge. We have already seen bad actors carry out impersonation-linked scams such as digital arrests through WhatsApp, and this feature could further help them,” a senior government official said, requesting anonymity.
In a statement, WhatsApp said it plans to roll out the features slowly later this year, but clarified it has built safeguards. “To protect against impersonation, we’ve held the highest-profile names — think public figures, government entities, celebrities, verified Meta accounts — so they can only ever be claimed by their legitimate owners and lookalike derivatives of known names are held as well.”
It said the users still require a phone number to use WhatsApp and that it has built multiple layers of defense against scams into usernames. “Other users need to know the exact username to message you, we will limit how many new people an account can contact, block repeated attempts to guess someone’s username key, and have systems to detect and remove activity showing common impersonation and abuse patterns,” the WhatsApp spokesperson said.
Further, it said, when the feature becomes available and someone sends a message for the first time via the username, WhatsApp will show if they are a new account, if they are in contact, if they are in common groups, and if they are based in a different country, so that one can choose whether or not to respond, the spokesperson said.
