Overview
Security researchers have discovered that WhatsApp chat histories may be stored unencrypted on both macOS and iOS, raising serious concerns about local data protection and cross‑application access within Apple’s ecosystem. The finding, disclosed by Mysk’s iOS security team, reveals that while WhatsApp’s end‑to‑end encryption (E2EE) protects messages in transit, it does not safeguard how those messages are stored once decrypted on the device.
Key Findings
- WhatsApp stores chat data in a SQLite database named
Axolotl.sqlite. - The file resides in a shared app group container:
group.net.whatsapp.WhatsApp.shared - This container is accessible to other Meta‑owned apps (e.g., Facebook, Instagram) that share the same developer permissions.
- The database is stored in plaintext, meaning unencrypted at rest.
While this design complies with Apple’s sandboxing model, it introduces a privacy gap — allowing authorized apps within the same developer group to potentially read sensitive chat data without explicit user consent.
Why It Matters
End‑to‑end encryption ensures that messages remain secure during transmission, but once decrypted locally, they are stored in a readable format. This exposes users to several risks:
- Cross‑app data access within the same developer ecosystem.
- Malicious app exploitation of shared container privileges.
- Forensic extraction from jailbroken or compromised devices.
- Insider misuse of legitimate app permissions.
On macOS, where file system access is more flexible, the risk is even higher if endpoint security controls are weak.
Mitigation and Recommendations
Users and organizations can take proactive steps to reduce exposure:
- Use strong passcodes and biometrics to protect device‑level access.
- Limit Meta ecosystem apps to minimize shared container exposure.
- Deploy MDM solutions in enterprise environments.
- Keep iOS, macOS, and WhatsApp updated for security improvements.
- Consider alternative messaging apps with stronger encryption‑at‑rest models for high‑security use cases.
Final Thought
This discovery underscores a broader challenge in modern messaging security: protecting data not only in transit but also at rest. As encryption becomes standard, attention must shift toward endpoint protection, where decrypted data inevitably resides.
The findings are likely to spark renewed scrutiny of how major apps handle local storage and whether encryption‑at‑rest should become a default privacy standard across all messaging platforms.
Leave a Reply