Silent Signals: Privacy Side Channels in Encrypted Messengers

This talk reveals critical privacy side channels in Signal and WhatsApp that enable attackers to monitor users without their knowledge or consent. Using only a target's phone number, researchers demonstrated how to track online activity, identify device types, detect usage patterns, and even launch denial-of-service attacks against billions of users.

Key vulnerabilities include device state tracking via silent pings, where delivery receipts (which can't be disabled) allow attackers to monitor online/offline status and differentiate between device states by measuring response times. The prekey mechanism can be exploited to deplete one-time prekeys, track device availability, identify operating systems, and create device fingerprints. Rapid prekey exhaustion can trigger server errors that block new conversations or calls, completely isolating users. Attackers can also drain device resources through invisible reaction messages, causing significant battery consumption (18% per hour) and data usage (13 GB per hour).

These vulnerabilities highlight how end-to-end encryption, while protecting message content, creates inherent privacy risks through implementation details that attackers can exploit to surveil users without consent.