A week ago, I reported a privacy vulnerability to Meta which may allow attackers to discover any WhatsApp users' devices details, including online status and operating system. This flaw enables adversaries to accurately target a vulnerable iOS (iPhone) device.

@Meta @WhatsApp Nice work! Thank you!

@Meta @WhatsApp power to the people

@Meta @WhatsApp 🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥

@Meta @WhatsApp Thanks man, I really appreciate your support

@Meta @WhatsApp Have Meta acknowledged?

@Meta @WhatsApp "A member of Meta’s security team has seen your report and performed an initial evaluation. We will get back to you once we have more information to share."

@yo_yo_yo_jbo @Meta @WhatsApp A member of Meta’s security team has seen your report and performed an initial evaluation. We will get back to you once we have more information to share. Next what response you got ?

@yo_yo_yo_jbo @Meta @WhatsApp It seems like @Meta @WhatsApp is taking this seriously. #Soon 👀

@yo_yo_yo_jbo @Meta @WhatsApp Nice in my case I also got response like that after one day it was closed as N/A

@yo_yo_yo_jbo @Meta @WhatsApp I had such too 🤷

@Meta @WhatsApp nice findings!

@Meta @WhatsApp Great work

@Meta @WhatsApp Thanks

@Meta @WhatsApp Are you part of the Whastapp security team? If not, where's the acknowledgement.

@Meta @WhatsApp R e s p e c t

@Meta @WhatsApp T h a n k s

@Meta @WhatsApp Thanks for the awesome work man. You save the world !

@Meta @WhatsApp Thanks. Just trying to do my part.

@Meta @WhatsApp Nice finding!

@Meta @WhatsApp Thanks

@Meta @WhatsApp Great work !!!

@Meta @WhatsApp Thanks!

@Meta @WhatsApp 🔥Big dubs.

@Meta @WhatsApp Impressive

@Meta @WhatsApp Thanks

@Meta @WhatsApp Nice work, friend! 💪

@Meta @WhatsApp Thanks mate :)

@mbrg0 @Meta @WhatsApp יש דרך לחסום את זה?

@mbrg0 @Meta @WhatsApp לא שאני מכיר. לחסום את המשתמש שסורק אותך עובד, אבל איך תדע מראש מי יסרוק אותך

How can normal user have access whatsapp web interface (eg: device management) console?

This screenshot/capture is of a tool I had created, not of WhatsApp web interface

@Meta @WhatsApp Any specific reason to call privacy vulnerability and not security vulnerability? Or both same?

@Meta @WhatsApp Good Q. There is an overlap.

@cyb3rops @Meta @WhatsApp Is the online status visible regarding the users privacy settings?

@cyb3rops @Meta @WhatsApp As far as I can tell, there is no way for users to protect themselves with relevant privacy settings.

@cyb3rops @Meta @WhatsApp Hmm interesting, would have thought that Settings > Privacy > Last seen & online > set to nobody + same as last seen, made a difference at least..

@cyb3rops @Meta @WhatsApp It does, but not for this issue. It's not using the user's online status

@Meta @WhatsApp So.. have WhatsApp found any conclusive evidence that anybody was fingerprinted/attacked by this or just the vulns?

@Meta @WhatsApp We will probably never know for certain

@Meta @WhatsApp Very curious to have further details, hope you will write something about it soon. Meanwhile, are you by chance using a rooted/jb device or are you directly interact with WhatsApp’s servers?

@Meta @WhatsApp I plan to write a detailed technical blog post about it, once @WhatsApp fixes it. To test these issues, I built (vibe coded 😅) my own tool, based on Baileys

@Meta @WhatsApp that's a really cool find!

@Meta @WhatsApp Thanks mate. Coming from you it's a real compliment

@Meta @WhatsApp hi Tal! I think this mostly overlaps with the findings we show in this paper: we reported the issue already back in 2024. also, the OS-fingerprinting (based on key-ids) was mentioned in another publication:

@Meta @WhatsApp Great work! I saw your 2024 paper a few weeks ago and decided to implement it. In my report to @WhatsApp I give credit to you (cannot share it publicly yet). I think I had added some new elements with the fingerprinting, that I cannot share yet

@Meta @WhatsApp so cool, i'm curious about the fingerprinting you found. good luck with the ticket! :) ...i know from experience that it's very hard to get some actual feedback from Meta 😅

@Meta @WhatsApp been there 😅

@Meta @WhatsApp got the scars... :)

@Meta @WhatsApp Did you get paid a good bounty?

@Meta @WhatsApp Thank you!!

@Meta @WhatsApp Thanks you for your support :)