Loading video...

Video Failed to Load

There was a problem loading this video. This could be due to a temporary network issue or the video might be unavailable.

A week ago, I reported a privacy vulnerability to Meta which may allow attackers to discover any WhatsApp users' devices details, including online status and operating system. This flaw enables adversaries to accurately target a vulnerable iOS (iPhone) device.

Tal Be'ery

11,247 subscribers

132,308 views • 1 year ago •via X (Twitter)

Science & Technology News & Politics

Anya Rossi• Live Now

Private livecam show

51 Comments

Cthulhu ( ;,;)1 year ago

@Meta @WhatsApp Nice work! Thank you!

Tal Be'ery1 year ago

@Meta @WhatsApp power to the people

mRr3b00t1 year ago

@Meta @WhatsApp 🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥

Tal Be'ery1 year ago

@Meta @WhatsApp Thanks man, I really appreciate your support

Jonathan Bar Or (JBO) 🇮🇱🇺🇸🇺🇦1 year ago

@Meta @WhatsApp Have Meta acknowledged?

Tal Be'ery1 year ago

@Meta @WhatsApp "A member of Meta’s security team has seen your report and performed an initial evaluation. We will get back to you once we have more information to share."

V A S I1 year ago

@yo_yo_yo_jbo @Meta @WhatsApp A member of Meta’s security team has seen your report and performed an initial evaluation. We will get back to you once we have more information to share. Next what response you got ?

Tal Be'ery1 year ago

@yo_yo_yo_jbo @Meta @WhatsApp It seems like @Meta @WhatsApp is taking this seriously. #Soon 👀

V A S I1 year ago

@yo_yo_yo_jbo @Meta @WhatsApp Nice in my case I also got response like that after one day it was closed as N/A

Tal Be'ery1 year ago

@yo_yo_yo_jbo @Meta @WhatsApp I had such too 🤷

@smagenil1 year ago

@Meta @WhatsApp nice findings!

McG1 year ago

@Meta @WhatsApp Great work

Tal Be'ery1 year ago

@Meta @WhatsApp Thanks

Yair Lifshitz1 year ago

@Meta @WhatsApp Are you part of the Whastapp security team? If not, where's the acknowledgement.

Tomer W1 year ago

@Meta @WhatsApp R e s p e c t

Tal Be'ery1 year ago

@Meta @WhatsApp T h a n k s

Saifuddin Amri1 year ago

@Meta @WhatsApp Thanks for the awesome work man. You save the world !

Tal Be'ery1 year ago

@Meta @WhatsApp Thanks. Just trying to do my part.

Igal Gofman1 year ago

@Meta @WhatsApp Nice finding!

Tal Be'ery1 year ago

@Meta @WhatsApp Thanks

Gospel1 year ago

@Meta @WhatsApp Great work !!!

Tal Be'ery1 year ago

@Meta @WhatsApp Thanks!

DIBSTER :)1 year ago

@Meta @WhatsApp 🔥Big dubs.

raiden1 year ago

@Meta @WhatsApp Impressive

Tal Be'ery1 year ago

@Meta @WhatsApp Thanks

Steve Borosh1 year ago

@Meta @WhatsApp Nice work, friend! 💪

Tal Be'ery1 year ago

@Meta @WhatsApp Thanks mate :)

Shaked Klein Orbach 🇮🇱1 year ago

@mbrg0 @Meta @WhatsApp יש דרך לחסום את זה?

Tal Be'ery1 year ago

@mbrg0 @Meta @WhatsApp לא שאני מכיר. לחסום את המשתמש שסורק אותך עובד, אבל איך תדע מראש מי יסרוק אותך

Romeo Whisky Sierra1 year ago

How can normal user have access whatsapp web interface (eg: device management) console?

Tal Be'ery1 year ago

This screenshot/capture is of a tool I had created, not of WhatsApp web interface

Romesh1 year ago

@Meta @WhatsApp Any specific reason to call privacy vulnerability and not security vulnerability? Or both same?

Tal Be'ery1 year ago

@Meta @WhatsApp Good Q. There is an overlap.

REni1 year ago

@cyb3rops @Meta @WhatsApp Is the online status visible regarding the users privacy settings?

Tal Be'ery1 year ago

@cyb3rops @Meta @WhatsApp As far as I can tell, there is no way for users to protect themselves with relevant privacy settings.

REni1 year ago

@cyb3rops @Meta @WhatsApp Hmm interesting, would have thought that Settings > Privacy > Last seen & online > set to nobody + same as last seen, made a difference at least..

Tal Be'ery1 year ago

@cyb3rops @Meta @WhatsApp It does, but not for this issue. It's not using the user's online status

Voidwalker1 year ago

@Meta @WhatsApp So.. have WhatsApp found any conclusive evidence that anybody was fingerprinted/attacked by this or just the vulns?

Tal Be'ery1 year ago

@Meta @WhatsApp We will probably never know for certain

p1tsi1 year ago

@Meta @WhatsApp Very curious to have further details, hope you will write something about it soon. Meanwhile, are you by chance using a rooted/jb device or are you directly interact with WhatsApp’s servers?

Tal Be'ery1 year ago

@Meta @WhatsApp I plan to write a detailed technical blog post about it, once @WhatsApp fixes it. To test these issues, I built (vibe coded 😅) my own tool, based on Baileys

Michael Bargury1 year ago

@Meta @WhatsApp that's a really cool find!

Tal Be'ery1 year ago

@Meta @WhatsApp Thanks mate. Coming from you it's a real compliment

Gabriel Gegenhuber1 year ago

@Meta @WhatsApp hi Tal! I think this mostly overlaps with the findings we show in this paper: we reported the issue already back in 2024. also, the OS-fingerprinting (based on key-ids) was mentioned in another publication:

Tal Be'ery1 year ago

@Meta @WhatsApp Great work! I saw your 2024 paper a few weeks ago and decided to implement it. In my report to @WhatsApp I give credit to you (cannot share it publicly yet). I think I had added some new elements with the fingerprinting, that I cannot share yet

Gabriel Gegenhuber1 year ago

@Meta @WhatsApp so cool, i'm curious about the fingerprinting you found. good luck with the ticket! :) ...i know from experience that it's very hard to get some actual feedback from Meta 😅

Tal Be'ery1 year ago

@Meta @WhatsApp been there 😅

Tal Be'ery1 year ago

@Meta @WhatsApp got the scars... :)

æ 🧙🏻‍♂️1 year ago

@Meta @WhatsApp Did you get paid a good bounty?

Mike Belshe1 year ago

@Meta @WhatsApp Thank you!!

Tal Be'ery1 year ago

@Meta @WhatsApp Thanks you for your support :)

Related Videos

Is iPhone affected? I have tested yesterday's published WhatsApp vulnerability against latest iOS and it is not affected This WhatsApp security issue affects only Android devices where it allows to access photos during a WhatsApp video call on PIN locked smartphone

Is iPhone affected? I have tested yesterday's published WhatsApp vulnerability against latest iOS and it is not affected This WhatsApp security issue affects only Android devices where it allows to access photos during a WhatsApp video call on PIN locked smartphone

Mobile Hacker

13,486 views • 1 month ago

Users who have Python installed on their PCs and use WhatsApp Desktop may be exposed to a security risk. A specially crafted .pyz (Python archive) file can be used to execute malicious code upon a single click, potentially compromising the system. A similar vulnerability was previously identified in Telegram Desktop and has since been remediated. At present, Meta does not recognize this behavior as a security issue, which may leave WhatsApp Desktop users at risk of exploitation.

Users who have Python installed on their PCs and use WhatsApp Desktop may be exposed to a security risk. A specially crafted .pyz (Python archive) file can be used to execute malicious code upon a single click, potentially compromising the system. A similar vulnerability was previously identified in Telegram Desktop and has since been remediated. At present, Meta does not recognize this behavior as a security issue, which may leave WhatsApp Desktop users at risk of exploitation.

H4x0r.DZ 🇰🇵

61,607 views • 1 year ago

At 0x41con, I talked about how a newer version of Trigon was developed for A7 - A9 and A11 devices. I demoed the following untethered iOS 14 jailbreak, which is 100% reliable on all devices thanks to Trigon - the following video shows it running on an iPhone 6S and an iPhone 7.

At 0x41con, I talked about how a newer version of Trigon was developed for A7 - A9 and A11 devices. I demoed the following untethered iOS 14 jailbreak, which is 100% reliable on all devices thanks to Trigon - the following video shows it running on an iPhone 6S and an iPhone 7.

Alfie

59,525 views • 1 year ago

QVAC first demo (android mobile) of its local on-device fine-tuning generalized framework, which aims to bring LORA fine-tuning to any device, scaling from the smallest embedded device to any smartphone, laptop, server, operating system. In combination with WIP multi-node features, we expect QVAC to become the standard for local on-device single/multi node inference and fine-tuning. Imagine a horde of AI agents being able to learn from your emails, notes and messages, maintaining 100℅ privacy, leveraging only your own devices. A P2P private intelligence network at your fingertips. That's how QVAC personal assistant will look like. Future of Intelligence won't be centralized. Infinite Ingelligence vibes.

QVAC first demo (android mobile) of its local on-device fine-tuning generalized framework, which aims to bring LORA fine-tuning to any device, scaling from the smallest embedded device to any smartphone, laptop, server, operating system. In combination with WIP multi-node features, we expect QVAC to become the standard for local on-device single/multi node inference and fine-tuning. Imagine a horde of AI agents being able to learn from your emails, notes and messages, maintaining 100℅ privacy, leveraging only your own devices. A P2P private intelligence network at your fingertips. That's how QVAC personal assistant will look like. Future of Intelligence won't be centralized. Infinite Ingelligence vibes.

Paolo Ardoino 🤖

142,902 views • 11 months ago

Padawans! Now, add liquidity to any JediSwap pool from any EVM chain with one click. ✅ Thanks to our frens at @widolabs, which enables the easiest onboarding for users to a Starknet dapp 🤝 Check out the last tweet to mint a Galxe NFT to commemorate this event ;)

Padawans! Now, add liquidity to any JediSwap pool from any EVM chain with one click. ✅ Thanks to our frens at @widolabs, which enables the easiest onboarding for users to a Starknet dapp 🤝 Check out the last tweet to mint a Galxe NFT to commemorate this event ;)

JediSwap

120,066 views • 3 years ago

Duckworth: "I think he personally is a compromised individual whom our adversaries are watching and digging the dirt on, and this makes him someone who's vulnerable to our adversaries."

Duckworth: "I think he personally is a compromised individual whom our adversaries are watching and digging the dirt on, and this makes him someone who's vulnerable to our adversaries."

Aaron Rupar

185,371 views • 1 year ago

It gets even more Sci-Fi! Apple also announced that the future accessibility update will include a new protocol to allow Brain Computer Interfaces (BCIs) to control iOS, iPadOS, and visionOS devices without any physical movements Such as devices from Synchron demoed here:

It gets even more Sci-Fi! Apple also announced that the future accessibility update will include a new protocol to allow Brain Computer Interfaces (BCIs) to control iOS, iPadOS, and visionOS devices without any physical movements Such as devices from Synchron demoed here:

Brad Lynch

67,089 views • 1 year ago

Your Headphones Can SPY Hundreds of millions of audio devices are vulnerable to a new Google Fast Pair exploit. Hackers can use this Bluetooth flaw to force pair, track your location, and even listen in on conversations.

Your Headphones Can SPY Hundreds of millions of audio devices are vulnerable to a new Google Fast Pair exploit. Hackers can use this Bluetooth flaw to force pair, track your location, and even listen in on conversations.

David Bombal

40,000 views • 8 months ago

iPhone Users Warning: Powerful New Hack Can Steal Your Data Without Clicks A dangerous new wave of iPhone hacking is raising global alarm. Advanced spyware like Darksword and Coruna can infect devices simply by visiting compromised websites, no downloads needed. Millions of iPhones running outdated iOS versions remain vulnerable, with attackers targeting users across multiple countries. Even more worrying, some tools can disable camera and microphone alerts, allowing silent surveillance. Experts warn that these powerful exploits are no longer limited to governments and are now reaching cybercriminal networks. Apple has released fixes, but many users have not updated their devices. Is your iPhone already exposed without you knowing? Credit : First Post.

iPhone Users Warning: Powerful New Hack Can Steal Your Data Without Clicks A dangerous new wave of iPhone hacking is raising global alarm. Advanced spyware like Darksword and Coruna can infect devices simply by visiting compromised websites, no downloads needed. Millions of iPhones running outdated iOS versions remain vulnerable, with attackers targeting users across multiple countries. Even more worrying, some tools can disable camera and microphone alerts, allowing silent surveillance. Experts warn that these powerful exploits are no longer limited to governments and are now reaching cybercriminal networks. Apple has released fixes, but many users have not updated their devices. Is your iPhone already exposed without you knowing? Credit : First Post.

Augadh

10,092 views • 6 months ago

BOOM! I now have a major update to GrokPod and can program just about anything from this miniature device! Up next I will be able to cast the code to any device, all from my voice on one of the smallest screen devices of any use. I also have another new way to capture video and audio! Stay tuned!

BOOM! I now have a major update to GrokPod and can program just about anything from this miniature device! Up next I will be able to cast the code to any device, all from my voice on one of the smallest screen devices of any use. I also have another new way to capture video and audio! Stay tuned!

Brian Roemmele

34,877 views • 25 days ago

When I think that the iPhone 16 will soon be released, and I who have just acquired a 12 Pro Max (new) with iOS 14.3 🙄. In the meantime, what a joy to get a device and be able to install almost everything you want 😁

When I think that the iPhone 16 will soon be released, and I who have just acquired a 12 Pro Max (new) with iOS 14.3 🙄. In the meantime, what a joy to get a device and be able to install almost everything you want 😁

Steph63

17,355 views • 2 years ago

Major announcements from Google AR & VR this morning including Android XR platform supporting both headsets and glasses. 👇🏽 👾 Android XR is an operating system for spatial computing devices bringing together years of investment in AI, AR, and VR. ♊️ Gemini will be available on devices as an always-ready AI agent to assist your needs. 🥽 Samsung mixed-reality headset, considered to be a mashup of the Meta Quest and Apple Vision Pro, to launch in 2025. 🕶️ Smart glasses, akin to Ray-Ban Meta, including an AR heads-up display actively being field-tested. More at:

Major announcements from Google AR & VR this morning including Android XR platform supporting both headsets and glasses. 👇🏽 👾 Android XR is an operating system for spatial computing devices bringing together years of investment in AI, AR, and VR. ♊️ Gemini will be available on devices as an always-ready AI agent to assist your needs. 🥽 Samsung mixed-reality headset, considered to be a mashup of the Meta Quest and Apple Vision Pro, to launch in 2025. 🕶️ Smart glasses, akin to Ray-Ban Meta, including an AR heads-up display actively being field-tested. More at:

asim ᯅ

28,112 views • 1 year ago

Hackers convince Meta AI to send a code to a 'new' email — possibly how the old Obama White House Instagram may have been hijacked The breach also hit high-value IG usernames like 'hey' and 'jowo' — which are worth over $1M combined Meta says the flaw is now fixed

Hackers convince Meta AI to send a code to a 'new' email — possibly how the old Obama White House Instagram may have been hijacked The breach also hit high-value IG usernames like 'hey' and 'jowo' — which are worth over $1M combined Meta says the flaw is now fixed

RT

201,715 views • 4 months ago

17 years ago today, Steve Jobs introduced us to the iPhone. "Well, today, we're introducing three revolutionary products of this class. The first one, is a widescreen iPod with touch controls. The second, is a revolutionary mobile phone. And the third, is a breakthrough Internet communications device. So, three things; a widescreen iPod with touch controls, a revolutionary mobile phone and a breakthrough Internet communications device. An iPod, a Phone and an Internet communications device … are you getting it? These are not three separate devices. This is one device – and we are calling it iPhone. Today, Apple is going to reinvent the phone."

17 years ago today, Steve Jobs introduced us to the iPhone. "Well, today, we're introducing three revolutionary products of this class. The first one, is a widescreen iPod with touch controls. The second, is a revolutionary mobile phone. And the third, is a breakthrough Internet communications device. So, three things; a widescreen iPod with touch controls, a revolutionary mobile phone and a breakthrough Internet communications device. An iPod, a Phone and an Internet communications device … are you getting it? These are not three separate devices. This is one device – and we are calling it iPhone. Today, Apple is going to reinvent the phone."

Brian Solis

18,080 views • 2 years ago

Be aware that your photos can be accessed without unlocking your phone when you receive a WhatsApp video call on Android. This is in plain sight. It's not hidden, not a secret feature. Not a hack. This has already been reported to Meta and Google. #Privacy #Security #Android17

Be aware that your photos can be accessed without unlocking your phone when you receive a WhatsApp video call on Android. This is in plain sight. It's not hidden, not a secret feature. Not a hack. This has already been reported to Meta and Google. #Privacy #Security #Android17

Jose Rodriguez

632,437 views • 1 month ago

Quick announcement for Legacy iOS Collectors, Recently, Apple did something to their activation server (under investigation), and now a lot of A5 devices (iOS 6-9 for now) along with my iPhone 5 on iOS 6 is stuck on an activation loop. DO NOT restore A5-A6 devices at this time.

Quick announcement for Legacy iOS Collectors, Recently, Apple did something to their activation server (under investigation), and now a lot of A5 devices (iOS 6-9 for now) along with my iPhone 5 on iOS 6 is stuck on an activation loop. DO NOT restore A5-A6 devices at this time.

Ben

45,001 views • 1 year ago

Big news! Meta has just announced that they're opening up Meta Horizon OS, the operating system powering Quest, to allow others to design more headsets using their ecosystem. Lenovo, Microsoft, and ASUS are among Meta's initial partners. This move could spark a new wave of headsets focused on productivity, entertainment, gaming, exercise and more.

Big news! Meta has just announced that they're opening up Meta Horizon OS, the operating system powering Quest, to allow others to design more headsets using their ecosystem. Lenovo, Microsoft, and ASUS are among Meta's initial partners. This move could spark a new wave of headsets focused on productivity, entertainment, gaming, exercise and more.

Nathie @ Meta Connect

2,008,139 views • 2 years ago