Video wird geladen...

Video konnte nicht geladen werden

Zur Startseite

A week ago, I reported a privacy vulnerability to Meta which may allow attackers to discover any WhatsApp users' devices details, including online status and operating system. This flaw enables adversaries to accurately target a vulnerable iOS (iPhone) device.

TalBeerySec's profile picture

Tal Be'ery

11,247 subscribers

132,308 Aufrufe • vor 1 Jahr •via X (Twitter)

Wissenschaft & TechnologieNachrichten & Politik
LIVE

Anya Rossi• Live Now

Private livecam show

51 Kommentare

Profilbild von Cthulhu ( ;,;)
Cthulhu ( ;,;)vor 1 Jahr

@Meta @WhatsApp Nice work! Thank you!

Profilbild von Tal Be'ery
Tal Be'eryvor 1 Jahr

@Meta @WhatsApp power to the people

Profilbild von mRr3b00t
mRr3b00tvor 1 Jahr

@Meta @WhatsApp 🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥

Profilbild von Tal Be'ery
Tal Be'eryvor 1 Jahr

@Meta @WhatsApp Thanks man, I really appreciate your support

Profilbild von Jonathan Bar Or (JBO) 🇮🇱🇺🇸🇺🇦
Jonathan Bar Or (JBO) 🇮🇱🇺🇸🇺🇦vor 1 Jahr

@Meta @WhatsApp Have Meta acknowledged?

Profilbild von Tal Be'ery
Tal Be'eryvor 1 Jahr

@Meta @WhatsApp "A member of Meta’s security team has seen your report and performed an initial evaluation. We will get back to you once we have more information to share."

Profilbild von V A S I
V A S Ivor 1 Jahr

@yo_yo_yo_jbo @Meta @WhatsApp A member of Meta’s security team has seen your report and performed an initial evaluation. We will get back to you once we have more information to share. Next what response you got ?

Profilbild von Tal Be'ery
Tal Be'eryvor 1 Jahr

@yo_yo_yo_jbo @Meta @WhatsApp It seems like @Meta @WhatsApp is taking this seriously. #Soon 👀

Profilbild von V A S I
V A S Ivor 1 Jahr

@yo_yo_yo_jbo @Meta @WhatsApp Nice in my case I also got response like that after one day it was closed as N/A

Profilbild von Tal Be'ery
Tal Be'eryvor 1 Jahr

@yo_yo_yo_jbo @Meta @WhatsApp I had such too 🤷

Profilbild von @smagenil
@smagenilvor 1 Jahr

@Meta @WhatsApp nice findings!

Profilbild von McG
McGvor 1 Jahr

@Meta @WhatsApp Great work

Profilbild von Tal Be'ery
Tal Be'eryvor 1 Jahr

@Meta @WhatsApp Thanks

Profilbild von Yair Lifshitz
Yair Lifshitzvor 1 Jahr

@Meta @WhatsApp Are you part of the Whastapp security team? If not, where's the acknowledgement.

Profilbild von Tomer W
Tomer Wvor 1 Jahr

@Meta @WhatsApp R e s p e c t

Profilbild von Tal Be'ery
Tal Be'eryvor 1 Jahr

@Meta @WhatsApp T h a n k s

Profilbild von Saifuddin Amri
Saifuddin Amrivor 1 Jahr

@Meta @WhatsApp Thanks for the awesome work man. You save the world !

Profilbild von Tal Be'ery
Tal Be'eryvor 1 Jahr

@Meta @WhatsApp Thanks. Just trying to do my part.

Profilbild von Igal Gofman
Igal Gofmanvor 1 Jahr

@Meta @WhatsApp Nice finding!

Profilbild von Tal Be'ery
Tal Be'eryvor 1 Jahr

@Meta @WhatsApp Thanks

Profilbild von Gospel
Gospelvor 1 Jahr

@Meta @WhatsApp Great work !!!

Profilbild von Tal Be'ery
Tal Be'eryvor 1 Jahr

@Meta @WhatsApp Thanks!

Profilbild von DIBSTER :)
DIBSTER :)vor 1 Jahr

@Meta @WhatsApp 🔥Big dubs.

Profilbild von raiden
raidenvor 1 Jahr

@Meta @WhatsApp Impressive

Profilbild von Tal Be'ery
Tal Be'eryvor 1 Jahr

@Meta @WhatsApp Thanks

Profilbild von Steve Borosh
Steve Boroshvor 1 Jahr

@Meta @WhatsApp Nice work, friend! 💪

Profilbild von Tal Be'ery
Tal Be'eryvor 1 Jahr

@Meta @WhatsApp Thanks mate :)

Profilbild von Shaked Klein Orbach 🇮🇱
Shaked Klein Orbach 🇮🇱vor 1 Jahr

@mbrg0 @Meta @WhatsApp יש דרך לחסום את זה?

Profilbild von Tal Be'ery
Tal Be'eryvor 1 Jahr

@mbrg0 @Meta @WhatsApp לא שאני מכיר. לחסום את המשתמש שסורק אותך עובד, אבל איך תדע מראש מי יסרוק אותך

Profilbild von Romeo Whisky Sierra
Romeo Whisky Sierravor 1 Jahr

How can normal user have access whatsapp web interface (eg: device management) console?

Profilbild von Tal Be'ery
Tal Be'eryvor 1 Jahr

This screenshot/capture is of a tool I had created, not of WhatsApp web interface

Profilbild von Romesh
Romeshvor 1 Jahr

@Meta @WhatsApp Any specific reason to call privacy vulnerability and not security vulnerability? Or both same?

Profilbild von Tal Be'ery
Tal Be'eryvor 1 Jahr

@Meta @WhatsApp Good Q. There is an overlap.

Profilbild von REni
REnivor 1 Jahr

@cyb3rops @Meta @WhatsApp Is the online status visible regarding the users privacy settings?

Profilbild von Tal Be'ery
Tal Be'eryvor 1 Jahr

@cyb3rops @Meta @WhatsApp As far as I can tell, there is no way for users to protect themselves with relevant privacy settings.

Profilbild von REni
REnivor 1 Jahr

@cyb3rops @Meta @WhatsApp Hmm interesting, would have thought that Settings > Privacy > Last seen & online > set to nobody + same as last seen, made a difference at least..

Profilbild von Tal Be'ery
Tal Be'eryvor 1 Jahr

@cyb3rops @Meta @WhatsApp It does, but not for this issue. It's not using the user's online status

Profilbild von Voidwalker
Voidwalkervor 1 Jahr

@Meta @WhatsApp So.. have WhatsApp found any conclusive evidence that anybody was fingerprinted/attacked by this or just the vulns?

Profilbild von Tal Be'ery
Tal Be'eryvor 1 Jahr

@Meta @WhatsApp We will probably never know for certain

Profilbild von p1tsi
p1tsivor 1 Jahr

@Meta @WhatsApp Very curious to have further details, hope you will write something about it soon. Meanwhile, are you by chance using a rooted/jb device or are you directly interact with WhatsApp’s servers?

Profilbild von Tal Be'ery
Tal Be'eryvor 1 Jahr

@Meta @WhatsApp I plan to write a detailed technical blog post about it, once @WhatsApp fixes it. To test these issues, I built (vibe coded 😅) my own tool, based on Baileys

Profilbild von Michael Bargury
Michael Barguryvor 1 Jahr

@Meta @WhatsApp that's a really cool find!

Profilbild von Tal Be'ery
Tal Be'eryvor 1 Jahr

@Meta @WhatsApp Thanks mate. Coming from you it's a real compliment

Profilbild von Gabriel Gegenhuber
Gabriel Gegenhubervor 1 Jahr

@Meta @WhatsApp hi Tal! I think this mostly overlaps with the findings we show in this paper: we reported the issue already back in 2024. also, the OS-fingerprinting (based on key-ids) was mentioned in another publication:

Profilbild von Tal Be'ery
Tal Be'eryvor 1 Jahr

@Meta @WhatsApp Great work! I saw your 2024 paper a few weeks ago and decided to implement it. In my report to @WhatsApp I give credit to you (cannot share it publicly yet). I think I had added some new elements with the fingerprinting, that I cannot share yet

Profilbild von Gabriel Gegenhuber
Gabriel Gegenhubervor 1 Jahr

@Meta @WhatsApp so cool, i'm curious about the fingerprinting you found. good luck with the ticket! :) ...i know from experience that it's very hard to get some actual feedback from Meta 😅

Profilbild von Tal Be'ery
Tal Be'eryvor 1 Jahr

@Meta @WhatsApp been there 😅

Profilbild von Tal Be'ery
Tal Be'eryvor 1 Jahr

@Meta @WhatsApp got the scars... :)

Profilbild von æ 🧙🏻‍♂️
æ 🧙🏻‍♂️vor 1 Jahr

@Meta @WhatsApp Did you get paid a good bounty?

Profilbild von Mike Belshe
Mike Belshevor 1 Jahr

@Meta @WhatsApp Thank you!!

Profilbild von Tal Be'ery
Tal Be'eryvor 1 Jahr

@Meta @WhatsApp Thanks you for your support :)

Ähnliche Videos

Is iPhone affected? I have tested yesterday's published WhatsApp vulnerability against latest iOS and it is not affected This WhatsApp security issue affects only Android devices where it allows to access photos during a WhatsApp video call on PIN locked smartphone
0:37

Is iPhone affected? I have tested yesterday's published WhatsApp vulnerability against latest iOS and it is not affected This WhatsApp security issue affects only Android devices where it allows to access photos during a WhatsApp video call on PIN locked smartphone

Mobile Hacker

13,486 Aufrufe • vor 1 Monat

Users who have Python installed on their PCs and use WhatsApp Desktop may be exposed to a security risk. A specially crafted .pyz (Python archive) file can be used to execute malicious code upon a single click, potentially compromising the system. A similar vulnerability was previously identified in Telegram Desktop and has since been remediated. At present, Meta does not recognize this behavior as a security issue, which may leave WhatsApp Desktop users at risk of exploitation.
0:20

Users who have Python installed on their PCs and use WhatsApp Desktop may be exposed to a security risk. A specially crafted .pyz (Python archive) file can be used to execute malicious code upon a single click, potentially compromising the system. A similar vulnerability was previously identified in Telegram Desktop and has since been remediated. At present, Meta does not recognize this behavior as a security issue, which may leave WhatsApp Desktop users at risk of exploitation.

H4x0r.DZ 🇰🇵

61,607 Aufrufe • vor 1 Jahr

At 0x41con, I talked about how a newer version of Trigon was developed for A7 - A9 and A11 devices. I demoed the following untethered iOS 14 jailbreak, which is 100% reliable on all devices thanks to Trigon - the following video shows it running on an iPhone 6S and an iPhone 7.
0:50

At 0x41con, I talked about how a newer version of Trigon was developed for A7 - A9 and A11 devices. I demoed the following untethered iOS 14 jailbreak, which is 100% reliable on all devices thanks to Trigon - the following video shows it running on an iPhone 6S and an iPhone 7.

Alfie

59,525 Aufrufe • vor 1 Jahr

QVAC first demo (android mobile) of its local on-device fine-tuning generalized framework, which aims to bring LORA fine-tuning to any device, scaling from the smallest embedded device to any smartphone, laptop, server, operating system. In combination with WIP multi-node features, we expect QVAC to become the standard for local on-device single/multi node inference and fine-tuning. Imagine a horde of AI agents being able to learn from your emails, notes and messages, maintaining 100℅ privacy, leveraging only your own devices. A P2P private intelligence network at your fingertips. That's how QVAC personal assistant will look like. Future of Intelligence won't be centralized. Infinite Ingelligence vibes.
1:49

QVAC first demo (android mobile) of its local on-device fine-tuning generalized framework, which aims to bring LORA fine-tuning to any device, scaling from the smallest embedded device to any smartphone, laptop, server, operating system. In combination with WIP multi-node features, we expect QVAC to become the standard for local on-device single/multi node inference and fine-tuning. Imagine a horde of AI agents being able to learn from your emails, notes and messages, maintaining 100℅ privacy, leveraging only your own devices. A P2P private intelligence network at your fingertips. That's how QVAC personal assistant will look like. Future of Intelligence won't be centralized. Infinite Ingelligence vibes.

Paolo Ardoino 🤖

142,902 Aufrufe • vor 11 Monaten

Padawans! Now, add liquidity to any JediSwap pool from any EVM chain with one click. ✅ Thanks to our frens at @widolabs, which enables the easiest onboarding for users to a Starknet dapp 🤝 Check out the last tweet to mint a Galxe NFT to commemorate this event ;)
0:45

Padawans! Now, add liquidity to any JediSwap pool from any EVM chain with one click. ✅ Thanks to our frens at @widolabs, which enables the easiest onboarding for users to a Starknet dapp 🤝 Check out the last tweet to mint a Galxe NFT to commemorate this event ;)

JediSwap

120,066 Aufrufe • vor 3 Jahren

Duckworth: "I think he personally is a compromised individual whom our adversaries are watching and digging the dirt on, and this makes him someone who's vulnerable to our adversaries."
0:40

Duckworth: "I think he personally is a compromised individual whom our adversaries are watching and digging the dirt on, and this makes him someone who's vulnerable to our adversaries."

Aaron Rupar

185,371 Aufrufe • vor 1 Jahr

It gets even more Sci-Fi! Apple also announced that the future accessibility update will include a new protocol to allow Brain Computer Interfaces (BCIs) to control iOS, iPadOS, and visionOS devices without any physical movements Such as devices from Synchron demoed here:
1:01

It gets even more Sci-Fi! Apple also announced that the future accessibility update will include a new protocol to allow Brain Computer Interfaces (BCIs) to control iOS, iPadOS, and visionOS devices without any physical movements Such as devices from Synchron demoed here:

Brad Lynch

67,089 Aufrufe • vor 1 Jahr

Your Headphones Can SPY Hundreds of millions of audio devices are vulnerable to a new Google Fast Pair exploit. Hackers can use this Bluetooth flaw to force pair, track your location, and even listen in on conversations.
2:59

Your Headphones Can SPY Hundreds of millions of audio devices are vulnerable to a new Google Fast Pair exploit. Hackers can use this Bluetooth flaw to force pair, track your location, and even listen in on conversations.

David Bombal

40,000 Aufrufe • vor 8 Monaten

iPhone Users Warning: Powerful New Hack Can Steal Your Data Without Clicks A dangerous new wave of iPhone hacking is raising global alarm. Advanced spyware like Darksword and Coruna can infect devices simply by visiting compromised websites, no downloads needed. Millions of iPhones running outdated iOS versions remain vulnerable, with attackers targeting users across multiple countries. Even more worrying, some tools can disable camera and microphone alerts, allowing silent surveillance. Experts warn that these powerful exploits are no longer limited to governments and are now reaching cybercriminal networks. Apple has released fixes, but many users have not updated their devices. Is your iPhone already exposed without you knowing? Credit : First Post.
3:48

iPhone Users Warning: Powerful New Hack Can Steal Your Data Without Clicks A dangerous new wave of iPhone hacking is raising global alarm. Advanced spyware like Darksword and Coruna can infect devices simply by visiting compromised websites, no downloads needed. Millions of iPhones running outdated iOS versions remain vulnerable, with attackers targeting users across multiple countries. Even more worrying, some tools can disable camera and microphone alerts, allowing silent surveillance. Experts warn that these powerful exploits are no longer limited to governments and are now reaching cybercriminal networks. Apple has released fixes, but many users have not updated their devices. Is your iPhone already exposed without you knowing? Credit : First Post.

Augadh

10,092 Aufrufe • vor 6 Monaten

BOOM! I now have a major update to GrokPod and can program just about anything from this miniature device! Up next I will be able to cast the code to any device, all from my voice on one of the smallest screen devices of any use. I also have another new way to capture video and audio! Stay tuned!
1:52

BOOM! I now have a major update to GrokPod and can program just about anything from this miniature device! Up next I will be able to cast the code to any device, all from my voice on one of the smallest screen devices of any use. I also have another new way to capture video and audio! Stay tuned!

Brian Roemmele

34,877 Aufrufe • vor 26 Tagen

When I think that the iPhone 16 will soon be released, and I who have just acquired a 12 Pro Max (new) with iOS 14.3 🙄. In the meantime, what a joy to get a device and be able to install almost everything you want 😁
0:23

When I think that the iPhone 16 will soon be released, and I who have just acquired a 12 Pro Max (new) with iOS 14.3 🙄. In the meantime, what a joy to get a device and be able to install almost everything you want 😁

Steph63

17,355 Aufrufe • vor 2 Jahren

Major announcements from Google AR & VR this morning including Android XR platform supporting both headsets and glasses. 👇🏽 👾 Android XR is an operating system for spatial computing devices bringing together years of investment in AI, AR, and VR. ♊️ Gemini will be available on devices as an always-ready AI agent to assist your needs. 🥽 Samsung mixed-reality headset, considered to be a mashup of the Meta Quest and Apple Vision Pro, to launch in 2025. 🕶️ Smart glasses, akin to Ray-Ban Meta, including an AR heads-up display actively being field-tested. More at:
2:05

Major announcements from Google AR & VR this morning including Android XR platform supporting both headsets and glasses. 👇🏽 👾 Android XR is an operating system for spatial computing devices bringing together years of investment in AI, AR, and VR. ♊️ Gemini will be available on devices as an always-ready AI agent to assist your needs. 🥽 Samsung mixed-reality headset, considered to be a mashup of the Meta Quest and Apple Vision Pro, to launch in 2025. 🕶️ Smart glasses, akin to Ray-Ban Meta, including an AR heads-up display actively being field-tested. More at:

asim ᯅ

28,112 Aufrufe • vor 1 Jahr

Hackers convince Meta AI to send a code to a 'new' email — possibly how the old Obama White House Instagram may have been hijacked The breach also hit high-value IG usernames like 'hey' and 'jowo' — which are worth over $1M combined Meta says the flaw is now fixed
1:29

Hackers convince Meta AI to send a code to a 'new' email — possibly how the old Obama White House Instagram may have been hijacked The breach also hit high-value IG usernames like 'hey' and 'jowo' — which are worth over $1M combined Meta says the flaw is now fixed

RT

201,715 Aufrufe • vor 4 Monaten

17 years ago today, Steve Jobs introduced us to the iPhone. "Well, today, we're introducing three revolutionary products of this class. The first one, is a widescreen iPod with touch controls. The second, is a revolutionary mobile phone. And the third, is a breakthrough Internet communications device. So, three things; a widescreen iPod with touch controls, a revolutionary mobile phone and a breakthrough Internet communications device. An iPod, a Phone and an Internet communications device … are you getting it? These are not three separate devices. This is one device – and we are calling it iPhone. Today, Apple is going to reinvent the phone."
1:09

17 years ago today, Steve Jobs introduced us to the iPhone. "Well, today, we're introducing three revolutionary products of this class. The first one, is a widescreen iPod with touch controls. The second, is a revolutionary mobile phone. And the third, is a breakthrough Internet communications device. So, three things; a widescreen iPod with touch controls, a revolutionary mobile phone and a breakthrough Internet communications device. An iPod, a Phone and an Internet communications device … are you getting it? These are not three separate devices. This is one device – and we are calling it iPhone. Today, Apple is going to reinvent the phone."

Brian Solis

18,080 Aufrufe • vor 2 Jahren

Be aware that your photos can be accessed without unlocking your phone when you receive a WhatsApp video call on Android. This is in plain sight. It's not hidden, not a secret feature. Not a hack. This has already been reported to Meta and Google. #Privacy #Security #Android17
0:23

Be aware that your photos can be accessed without unlocking your phone when you receive a WhatsApp video call on Android. This is in plain sight. It's not hidden, not a secret feature. Not a hack. This has already been reported to Meta and Google. #Privacy #Security #Android17

Jose Rodriguez

632,437 Aufrufe • vor 1 Monat

Quick announcement for Legacy iOS Collectors, Recently, Apple did something to their activation server (under investigation), and now a lot of A5 devices (iOS 6-9 for now) along with my iPhone 5 on iOS 6 is stuck on an activation loop. DO NOT restore A5-A6 devices at this time.
0:34

Quick announcement for Legacy iOS Collectors, Recently, Apple did something to their activation server (under investigation), and now a lot of A5 devices (iOS 6-9 for now) along with my iPhone 5 on iOS 6 is stuck on an activation loop. DO NOT restore A5-A6 devices at this time.

Ben

45,001 Aufrufe • vor 1 Jahr

Big news! Meta has just announced that they're opening up Meta Horizon OS, the operating system powering Quest, to allow others to design more headsets using their ecosystem. Lenovo, Microsoft, and ASUS are among Meta's initial partners. This move could spark a new wave of headsets focused on productivity, entertainment, gaming, exercise and more.
2:54

Big news! Meta has just announced that they're opening up Meta Horizon OS, the operating system powering Quest, to allow others to design more headsets using their ecosystem. Lenovo, Microsoft, and ASUS are among Meta's initial partners. This move could spark a new wave of headsets focused on productivity, entertainment, gaming, exercise and more.

Nathie @ Meta Connect

2,008,139 Aufrufe • vor 2 Jahren