A new security finding shows that just having your phone number may be enough for attackers to quietly learn:
- When you are online
- What device you use
- Your activity patterns
All without your knowledge.
The discovery
Security researcher Tal Be'ery demonstrated how WhatsApp can leak sensitive metadata using only:
👉 A phone number
👉 Custom interaction with WhatsApp Web
No malware. No exploit. No hacking in the traditional sense.
“It’s not breaking encryption — it’s using how the system is designed.”
What attackers can learn
Using these techniques, attackers can:
⏱️ Track your activity
- Detect when you are online
- Map your daily routine
- Identify sleep/work patterns
📱 Identify your devices
- iPhone vs Android
- Desktop vs mobile usage
- Linked devices on your account
🎯 Optimize attacks
- Send phishing messages at the “perfect” time
- Tailor exploits to your specific device
- Increase the success rate of scams or spyware
How the technique works
1. Silent “pings”
Attackers can send hidden messages that:
- Do not appear on your device
- Still trigger delivery receipts
👉 This allows them to measure:
- When you are active
- How quickly your device responds
2. Device fingerprinting
WhatsApp’s encryption system assigns:
- Unique keys to each device
- Identifiers based on the operating system
👉 By simply starting a chat, attackers can infer:
- What devices you use
- How many devices are linked
Why this is concerning
This is not a vulnerability in the traditional sense.
👉 It’s a design-level issue
End-to-end encryption protects message content —
but metadata remains exposed
Real-world risks
🕵️ Surveillance & profiling
- Track user behavior without consent
- Build detailed activity patterns
🎯 Phishing & scams
- Send messages when users are most vulnerable
- Improve the success of social engineering attacks
🧬 Targeted spyware
- Identify exact device type
- Deploy tailored exploits
🔋 Resource abuse
- Continuous silent pings can:
- Drain battery
- Consume resources
The root problem: open communication model
WhatsApp allows:
👉 Anyone can message anyone (if they have your number)
Compared to platforms like:
👉 There are fewer restrictions and less filtering
This creates a larger attack surface.
What is Meta doing?
Meta has introduced mitigations such as:
- Silence Unknown Callers
- Rate limiting
- Blocking some silent ping techniques
However:
These fixes are incremental — not fundamental
The bigger challenge
Each new feature (polls, media, location sharing, etc.):
👉 Creates new ways to send hidden signals
This leads to a “whack-a-mole” security problem
How to protect yourself
1. Be cautious with unknown contacts
Ignore unexpected messages — even simple “Hi” texts
2. Limit exposure of your phone number
Avoid sharing it publicly where possible
3. Review WhatsApp privacy settings
Restrict:
- Who can see your status
- Who can add you to groups
4. Enable advanced protections
Use features like:
- Silent unknown callers
- Strict account settings (if available)
Key takeaway
Encryption protects your messages — not your metadata.
This research highlights a critical shift in cybersecurity:
👉 Attackers don’t always need to break systems
👉 Sometimes they just need to observe them
