Beware WhatsApp clones in South Africa

South Africans should beware of using unofficial WhatsApp apps as these could not only compromise their personal data, infect their devices with malware, and result in bans by official WhatsApp developer Meta Platforms.

A MyBroadband reader recently notified us that the WhatsApp app on a Huawei smartphone had stopped working.

He said that he suspected the issue was due to the Gbox emulation software used to enable the installation and use of Google apps and Google Mobile Services on Huawei phones.

We found that explanation curious, as WhatsApp provides an official APK file for its app directly on its website.

That means Huawei users do not have to use the Gbox emulation software to download the real WhatsApp app.

The user subsequently said that a staff member at an MTN store was able to install an official version of WhatsApp that worked. He also said that the employee had registered his account with a new number.

The last bit of information supported what we had suspected: the user was locked out of WhatsApp for using a third-party unofficial WhatsApp app.

A little digging revealed that the same error message has been shown to several users of unofficial WhatsApp clients like GBWhatsApp or WhatsApp Plus in the past.

In certain cases, WhatsApp owner Meta Platforms banned these users from using the instant messaging service.

GBWhatsApp, in particular, has proven popular for its wide range of features not available on the official WhatsApp app, including:

• Hiding your online status from known contacts
• Disabling read receipts for received or sent messages
• Viewing deleted messages
• Message scheduling and automated replies
• Retrieving deleted statuses of other users
• Retrieving media sent to you after the sender had deleted it
• Increased size limits for media sharing
• Sending up to 90 images at once
• Blocking certain or all users from being able to call you on WhatsApp
• Using multiple accounts on one app

While some of these features might sound great at first, they come with substantial compromises.

GBWhatsApp and similar unapproved WhatsApp clients use modified WhatsApp code, allowing for injecting malware and other malicious software.

This can be used to steal your data or take over your device, which may lead to significant financial damages.

In addition, unofficial WhatsApp clients don’t support full end-to-end encryption (E2EE) for all chats.

E2EE is an essential feature for ensuring messages sent over an Internet-based service cannot be read when intercepted. This has been one of the key security benefits WhatsApp rolled out in recent years.

Even if an unofficial WhatsApp client did not have malicious software and its developer did not have foul intentions, another ill-meaning third party could compromise a user’s data.

These shortcomings explain why GBWhatsApp and other unofficial WhatsApp clients cannot be downloaded from the Apple App Store or Google Play Store but are only available on the web.

In addition to violating WhatsApp’s Terms of Service, they do not meet basic privacy and security standards.

A code analysis by Alameen Merali showed that GB WhatsApp has significant permissions to features on users’ phones that go well beyond the capabilities WhatsApp needs to access. These include:

• Composing and sending SMSs in the background
• Downloading files from unknown sources on the web
• Connect with command and control servers that could be used to remotely control the device
• Reading and using local login credentials stored on your device — including cookies for account services
• Permissions to use payment systems

Another good reason to avoid these apps is the severe penalties Meta can impose on the numbers found to be using them.

“Using an unauthorised application and/or unsupported device violates our Terms of Service and can result in your account being banned,” WhatsApp explains on its website.

“We don’t support these apps because we can’t validate their security practices.”

Bans can range from a few hours to indefinite, so there is a risk that you will never be able to use your number on WhatsApp again.