WhatsApp Metadata Leaks Let Attackers Track Online Habits and Device Types

Summary

Tal Be’ery says WhatsApp Web silent pings can reveal users’ online habits, while per-device encryption fingerprints can expose their registered device types. Meta confirmed the findings and has made partial fixes.

Key points

A custom WhatsApp Web program can send silent messages and use delivery-receipt timing to infer when a user is online.
Starting a chat can expose per-device key material and IDs, allowing a person with the target’s phone number to fingerprint their registered device types without notifying them.
Be’ery says the information could help attackers tailor phishing or spyware, while device details could also enable surveillance pricing.
Meta confirmed Be’ery’s findings and has quietly removed some silent-ping methods.
Be’ery said the Android fingerprinting method he used stopped working, but iPhones still exposed sufficient metadata at the time of reporting.
Meta has used measures including rate limiting and Silence Unknown Callers; Be’ery argues that restricting contact from strangers would address the broader issue.

Article Details

Event Type: Security research finding on metadata exposure in WhatsApp
Impact: The research showed that a person with a target’s phone number can use silent pings to infer when the target is online and can learn registered device types from encryption metadata, without alerting the target. This may enable surveillance, more tailored phishing or spyware attacks, and potentially battery drain. Meta has made piecemeal mitigations; the article reports that some Android device fingerprinting and silent-ping methods no longer work, while metadata leakage remains.

People

Tal Be’eryDemonstrated and reported the WhatsApp metadata-leak research, including silent pings and device fingerprinting; he is identified as Zengo’s cofounder and CTO.

Vendors

MetaMeta has applied piecemeal fixes for specific message types, but critics say a broader contact-restriction approach would be more effective.

Products

WhatsAppTal Be’ery showed that WhatsApp leaks metadata that lets an attacker silently learn when someone is online and which devices they use by exploiting WhatsApp Web and per-device encryption fingerprints.WhatsApp WebTal Be’ery showed that WhatsApp leaks metadata that lets an attacker silently learn when someone is online and which devices they use by exploiting WhatsApp Web and per-device encryption fingerprints.