19
Careless Whisper: Exploiting Silent Delivery Receipts to Monitor Users on Mobile Instant Messengers (WhatsApp and Signal) (arxiv.org)
submitted 10 months ago by to c/privacy@programming.dev
1 comment fedilink hide all child comments
 
 With over 3 billion users globally, mobile instant messaging apps have become indispensable for both personal and professional communication. Besides plain messaging, many services implement additional features such as delivery and read receipts informing a user when a message has successfully reached its target. This paper highlights that delivery receipts can pose significant privacy risks to users. We use specifically crafted messages that trigger delivery receipts allowing any user to be pinged without their knowledge or consent. By using this technique at high frequency, we demonstrate how an attacker could extract private information such as the online and activity status of a victim, e.g., screen on/off. Moreover, we can infer the number of currently active user devices and their operating system, as well as launch resource exhaustion attacks, such as draining a user's battery or data allowance, all without generating any notification on the target side. Due to the widespread adoption of vulnerable messengers (WhatsApp and Signal) and the fact that any user can be targeted simply by knowing their phone number, we argue for a design change to address this issue.

easy-to-use implementation of the attack: https://github.com/gommzystudio/device-activity-tracker

signal developers discussion about it https://github.com/signalapp/Signal-Android/pull/14463 (WONTFIX)

1 comment

sorted by: hot top controversial new old
[–] 1 point 10 months ago

DeltaChat ftw

  • permalink
  • fedilink
  • source
    •
    7 comments in c/privacy@lemmy.ml view that post
    [–] 5 points 10 months ago (1 child)

    Is there any reason to use Signal over Matrix?

  • permalink
  • fedilink
  • source
  • hideshow 1 child comment
    •
    • [–] 3 points 10 months ago (3 children)

    You can literally turn off read receipts in signal

  • permalink
  • fedilink
  • source
  • hideshow 3 child comments
    •
  • [–] [S] 15 points 10 months ago* (2 children)

    You can literally turn off read receipts in signal

    But you can't turn off delivery receipts, which is what this attack uses.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 2 points 10 months ago (1 child)

    But you can turn off sealed sender messages from anyone, so they'd have to already be a trusted contact

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] [S] 13 points 10 months ago

    But you can turn off sealed sender messages from anyone, so they’d have to already be a trusted contact

    The setting to mitigate this attack (so that only people who know your username can do it, instead of anybody who knows your number) is called Who Can Find Me By Number. According to the docs, setting it to nobody requires also setting Who Can See My Number to nobody. Those two settings are both entirely unrelated to Signal's "sealed sender" thing, which incidentally is itself cryptography theater, btw.

  • permalink
  • fedilink
  • source
  • parent
    • [–] 4 points 10 months ago

    I remember trying to sign up for signal and stopped when it wanted my phone number. It's no longer anonymous at that point. When I talk about it theres always people who come at me about it being secure and whats my attack vector? Well, its not secure. My vector is a desire to be anonymous, and clearly the anonymity this presents is a facade.

  • permalink
  • fedilink
  • source
    •