| |
Contents
An interesting attack at a high technical level works via delivery confirmations from messengers—without the victim noticing. This makes it possible to find out when the cell phone is being used, what devices you have, or when you are at home or in the office, for example.
… By using this technique at high frequency, we demonstrate how an attacker could extract private information such as following a user across different companion devices, inferring their daily schedule, or deducing current activities. Moreover, we can infer the number of currently active user sessions (i.e., main and companion devices) and their operating system, as well as launch resource exhaustion attacks, such as draining a user’s battery or data allowance, all without generating any notification on the target side. …
(highlighting added retrospectively)
This is not a case of exploiting a bug, but rather a necessary implementation that is simply being used (misused) in an “alternative” way.
German article of heise.de from August 12, 2025 on this topic: (What WhatsApp and Signal reveal despite encryption …)(https://www.heise.de/news/Was-Whatsapp-und-Signal-verraten-trotz-Verschluesselung-10515767.html) (external)
Source: [Careless Whisper: Exploiting Silent Delivery Receipts to Monitor Users on Mobile Instant Messengers] (https://arxiv.org/abs/2411.11194) (external); PDF (external)
Technically, it is easier to monitor and spy on friends and/or strangers (not allowed too!) using their online status, as there has long been an unnoticed security gap:
Users of the messenger could be monitored with the help of a simple trick. Dutchman Loran Kloeze and US software developer Robert Heaton explain on their website how easy it is to monitor other users in the messenger WhatApp. The weak point is the online status, which can be used to retrieve specific information. All that is needed for monitoring is the victim’s telephone number.
The online status is systematically monitored by a Chrome extension while Web-WhatsApp is running. Regular queries can be used to obtain an activity log, which in turn allows conclusions to be drawn about the user’s daily routine - for example
Even “hiding” the online status does not help the user in this case of spying. By matching two telephone numbers, it is also possible to find out whether
At first glance, the information spied on seems unspectacular and is unlikely to be a major problem for most users. Nevertheless, the security gap allows detailed user logs to be created, for which advertisers or other interested parties would pay a lot of money. In the worst case scenario, the data collected could be misused for criminal purposes.
** WhatsApp statement:**
In a nutshell: WhatsApp is aware of the vulnerability, but does not see it as a security problem.
Here are the explanations of how it works. The prerequisite for both experiments is that “WhatsApp Web “ is started in the browser.
With this Chrome extension, many consecutive phone numbers are displayed in a freely selectable area.
Source: https://github.com/LoranKloeze/WhatsAllApp (external)
// NOTE - Requires jQuery
setInterval(function() {
var lastSeen = $('.pane-header .chat-body .emojitext').last().text();
console.log(Math.floor(Date.now() / 1000) + ", " + lastSeen);
}, 1000);
… which only needs to be changed from “lastSeen” to retrieving the “online status”.
Source:
https://robertheaton.com/2017/10/09/tracking-friends-and-strangers-using-whatsapp/ (external)
The University of Erlangen-Nuremberg also demonstrates the possibilities of monitoring with its project “Onlinestatusmonitor” (external).
Ethical considerations (translated from the contents of the website)
To protect the privacy of each randomly selected user, all statistics described in this section are based on anonymized data. Although we have tracked the exact online times of each user over several months, we have decided not to publish this data, but only to provide average cumulative statistics. Furthermore, we have taken some additional measures, such as blurring profile pictures and masking individual phone numbers. The data set is used for research purposes only and is not shared. These measures allow us to demonstrate the practical relevance and impact of permanently monitoring Messenger users while ensuring that the privacy of each randomly selected Messenger user is maintained.
A collaborative study by TU Darmstadt, TU Graz and the University of Würzburg shows that current methods for mobile contact tracing pose a massive threat to users’ privacy:
Quote: Our study of three popular mobile messengers (WhatsApp, Signal and Telegram) shows that, contrary to all expectations, so-called crawling attacks are possible on a large scale. Using an accurate database of mobile number prefixes and very few resources, we were able to retrieve 10% of all US mobile numbers for WhatsApp and 100% for Signal. Regarding Telegram, it turns out that its API reveals a lot of sensitive information, even about phone numbers that are not registered with the service.
Source: https://contact-discovery.github.io/de/ (external)
Spying on status is not a unique feature of WhatsApp. For example, Microsoft Teams has a feature that notifies you when the status of up to 16 contacts changes. This cannot be disabled in the settings, meaning that every user (colleagues, employees, and managers) can automatically check the status of these contacts.
This feature in MS Teams seems even more concerning and realistic because it is very easy to use and can be accessed immediately by any user.
Nothing to hide? Systematic recording of status can also lead to bullying or even defamation of individuals. But even under labor law, recording and evaluating status for the purpose of monitoring performance and behavior is certainly not permissible—especially with regard to data protection.
| Important: |
| The information and the script are for demonstration purposes only and may only be used for monitoring purposes with the consent of the persons concerned! |
Notes:
The script is not intended for spying on / denouncing people, but should make clear the simple realization and the potential danger.
Use at your own risk.
Everything that is technically possible is done - WhatsApp spying is no exception. But the “misconduct” of centralized services (Google/WhatsApp/Facebook, …) should not be used as a justification for your own “spying”.
| Important: |
| Spying on the privacy of friends/acquaintances/strangers is immoral, impolite and possibly even prohibited/punishable! |
Sources:
https://www.hna.de/netzwelt/grosse-sicherheitsluecke-bei-whatsapp-entdeckt-zr-8318025.html
http://www.chip.de/news/WhatsApp-Sicherheitsluecke-erlaubt-Ueberwachung-von-Freunden_124936240.html
Englisch:
https://www.lorankloeze.nl/2017/05/07/collecting-huge-amounts-of-data-with-whatsapp/
https://robertheaton.com/2017/10/09/tracking-friends-and-strangers-using-whatsapp/
https://www.onlinestatusmonitor.com
Supplementary information on the topic is provided here: