Hacking Reactions + Receipts = Free Spyware (WhatsApp and Signal)
Researchers have exposed how delivery receipts and reactions on messaging apps like WhatsApp and Signal can be exploited for surveillance, revealing user activity and device information without malware, simply by knowing a phone number.
MAIN POINTS FROM TRANSCRIPT
- Delivery receipts can reveal phone status and user activity without notifications.
- Reactions can be spammed invisibly, bypassing notifications and exploiting lack of rate limiting.
- Device fingerprinting is possible, identifying phone brands and connection types.
- Desktop clients exacerbate the issue, allowing tracking of multiple devices.
TAKEAWAYS
- Surveillance can occur without malware, just by knowing a phone number.
- Delivery receipts are integral and cannot be disabled, unlike read receipts.
- Different devices and connections have distinct response times, aiding identification.
- Multiple devices increase vulnerability, allowing comprehensive tracking of user activity.