Is Business Tools CRM safe?
Business Tools CRM reads your WhatsApp Web phone number and sends it with usage events to an Alibaba Cloud log service.
On web.whatsapp.com the extension reads the logged-in account's phone number from the page's local storage. It attaches that number, a country code and device details to usage events, and CRM request paths and parameters are logged too. The events go to a third-party Alibaba Cloud log project rather than the vendor's own API.
Who publishes itSo Lets Talk Digital - 13 other listings from the same operator, 3 of them carrying a finding
So Lets Talk Digital - 13 other listings from the same operator, 3 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
13 other listings published from this account, 2k+ users between them. 3 of them carry a finding.
Shared hosts - 1 hostname
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
CRM extension adds your WhatsApp number to telemetry sent to Alibaba Cloud
Code analysis shows the extension reads your WhatsApp number from web.whatsapp.com storage and includes it in event logs sent to us-west-1.log.aliyuncs.com.
Not yet observed at runtime.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Static analysis
You open web.whatsapp.com while logged in.
It reads your WhatsApp number and sends it in an event to an Alibaba Cloud log project.
Events fire on open and on CRM actions.
Phone number read from localStorage
Phone number added to every event
background.jsfunction C(t, e) { var n = e.logger_info, r = e.userId, o = S() return { event_source: _.EVENT_SOURCE, event_type: t, event_time: Math.round(new Date() / 1e3), install_time: void 0 === n ? '' : n.install_time, uuid: void 0 === n ? '' : n.uuid, c_user_phone: o.phoneNumber, c_country_code: o.countryName, platform: o.platform, user_agent: o.userAgent, language: o.language, user_id: r, } }- Phone numberc_user_phone: (account number, digits only)
The number of the WhatsApp account you are logged in with.
- Countryc_country_code: (derived region)
Country derived from the phone number prefix.
- Install IDuuid: (install identifier)
A per-install identifier that links events together.
- Browser detailsuser_agent, platform, language
User agent, platform and language of your browser.
- us-west-1.log.aliyuncs.com
Alibaba Cloud Log Service; project extension-us, logstore scrm-user.
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.
Where it sends data
Destinations our analysis observed Business Tools CRM contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- us-west-1.log.aliyuncs.com
Business Tools CRM sends data to us-west-1.log.aliyuncs.com. 11 other extensions we have analysed send data here.