Careless Whisper: Exploiting Stealthy End-to-End Leakage in Mobile Instant Messengers

2024-11-17

arXiv.org

AI Summary

This study uncovers a covert privacy threat in delivery receipt mechanisms of mobile instant messaging applications (e.g., WhatsApp, Signal): adversaries can remotely and imperceptibly probe user device states and exhaust resources—without user knowledge or consent—by sending high-frequency crafted messages to trigger receipts, thereby establishing a timing-based side channel. Methodologically, the work integrates protocol reverse engineering, timing-channel modeling, high-rate receipt triggering, and statistical inference to systematically demonstrate, for the first time, that end-to-end encrypted apps’ delivery receipts can be weaponized for side-channel attacks. Experiments on real devices achieve >92% accuracy in online status detection and successfully infer screen-on/off state, number of active devices, and OS type; battery and data-plan exhaustion attacks are also validated. The findings compel messaging platform vendors to redesign receipt mechanisms to mitigate such threats.

Technology Category

• Machine Learning: Privacy
• Application Domains: Mobility, Driving & Flight
• Planning, Routing, and Scheduling: Applications

Application Category

• Security and Privacy: Large-scale security measurements
• Systems and Infrastructure for Web, Mobile and WoT: Energy management for devices in mobile Web and WoT environments
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems

Abstract

With over 3 billion users globally, mobile instant messaging apps have become indispensable for both personal and professional communication. Besides plain messaging, many services implement additional features such as delivery and read receipts informing a user when a message has successfully reached its target. This paper highlights that delivery receipts can pose significant privacy risks to users. We use specifically crafted messages that trigger delivery receipts allowing any user to be pinged without their knowledge or consent. By using this technique at high frequency, we demonstrate how an attacker could extract private information such as the online and activity status of a victim, e.g., screen on/off. Moreover, we can infer the number of currently active user devices and their operating system, as well as launch resource exhaustion attacks, such as draining a user's battery or data allowance, all without generating any notification on the target side. Due to the widespread adoption of vulnerable messengers (WhatsApp and Signal) and the fact that any user can be targeted simply by knowing their phone number, we argue for a design change to address this issue.

Problem

• Exploiting silent delivery receipts to monitor user activity
• Extracting private info like online status and device details
• Launching resource exhaustion attacks without user notification

Innovation

• Exploiting silent delivery receipts for monitoring
• High-frequency crafted messages extract private data
• Resource exhaustion attacks without target notification