WhatsApp Vulnerabilities Leak User Metadata, Including Device Operating System Details

Meta’s WhatsApp has quietly begun implementing fixes for critical device fingerprinting vulnerabilities that expose users’ operating system information to potential attackers. The privacy flaws affect over 3 billion monthly active users and could enable threat actors to conduct targeted reconnaissance before launching sophisticated malware campaigns. Understanding the Fingerprinting Threat Security researchers discovered that WhatsApp’s end-to-end encryption (E2EE) multi-device protocol inadvertently leaks device metadata. Under this architecture, each receiving device maintains a separate encryption session with a distinct key, making each device identifiable. WhatsApp device fingerprinting issue in a nutshell Attackers leveraging WhatsApp as an attack vector can query WhatsApp servers for encryption material and extract device-specific information without any user interaction. This reconnaissance capability poses significant risks to users worldwide. Recent research demonstrated that implementation differences in key ID generation allow attackers to fingerprint victims’ exact operating systems, distinguishing between Android and iPhone devices. This identification capability is crucial for advanced persistent threat (APT) actors deploying platform-specific zero-day exploits. Sending an Android exploit to an iPhone would not only fail but also potentially alert victims and compromise sophisticated attack infrastructure worth millions of dollars. For threat actors, precise device identification before launching attacks is essential for operational security. WhatsApp Device
Read More