How (almost) any phone number can be tracked via WhatsApp & Signal – open-source PoC - WhatsApp & Signal Vulnerability

I’ve been playing with the “Careless Whisper” side-channel idea and hacked together a small PoC that shows how you can track a phone’s device activity state (screen on/off, offline) via WhatsApp – without any notifications or visible messages on the victim’s side. How it works (very roughly): - uses WhatsApp via an unofficial API - sends tiny “probe” reactions to special/invalid message IDs - WhatsApp still sends back silent delivery receipts - I just measure the round-trip time (RTT) of those receipts From that, you start seeing patterns like: - low RTT ≈ screen on / active, usually on Wi-Fi - a bit higher RTT ≈ screen on / active, on mobile data - high RTT ≈ screen off / standby on Wi-Fi - very high RTT ≈ screen off / standby on mobile data / bad reception - timeouts / repeated failures ≈ offline (airplane mode, no network, etc.) *depends on device The target never sees any message, notification or reaction. The same class of leak exists for Signal as well (per the original paper). In theory you’d still see this in raw network traffic (weird, regular probe pattern), and on the victim side it will slowly burn through a bit more mobile data and battery than “normal” idle usage. Over time you can use this to infer behavior: - when someone is probably at home (stable Wi-Fi RTT) - when they’re likely sleeping (long standby/offline stretches) - when they’re out and moving around (mobile data RTT patterns) So in theory you can slowly build a profile of when a person is home, asleep, or out — and this kind of tracking could already be happening without people realizing it. Quick “hotfix” for normal users: Go into the privacy settings of WhatsApp and Signal and turn off / restrict that unknown numbers can message you (e.g. WhatsApp: Settings → Privacy → Advanced). The attack basically requires that someone can send stuff to your number at all – limiting that already kills a big chunk of the risk. My open-source implementation (research / educational use only): https://github.com/gommzystudio/device-activity-tracker Original Paper: https://arxiv.org/abs/2411.11194 submitted by /u/Economy-Treat-768 [link] [comments]

from hacking: security in practice https://ift.tt/DyRYevA