Researchers from the University of Vienna, led by Max Guenther, have identified a fundamental vulnerability in WhatsApp and Signal. The flaw allows attackers to track a user's location and activity by knowing only their phone number.
The vulnerability is based on the Round Trip Time (RTT) of delivery notifications. While read receipts are manual, delivery notifications are sent automatically, even for messages marked as spam. Attackers can use simple scripts from platforms like GitHub to analyze RTT fluctuations.
By analyzing RTT, attackers can determine if a device is unlocked or active, identify stationary networks like office Wi-Fi, or track movement between cell towers. This allows for continuous monitoring of the user's device and usage patterns.
Meta paid the researchers a reward of $7 thousand for the report. Signal, as a non-profit organization, provided no compensation. Both companies have implemented rate limiting to slow down the frequency of requests, but the vulnerability cannot be fully eliminated because delivery notifications are a core feature of these platforms.
