Exploiting Security Side Channels in E2E Encrypted Messengers

Silent Signals: Exploiting Security and Privacy Side Channels in End-to-End Encrypted Messengers

Speakers: Gabriel Gegenhuber, Maximilian Günther

Conference: DEF CON 33

YouTube: https://www.youtube.com/watch?v=BgneDTH81EY

Slides: https://media.defcon.org/DEF%20CON%2033/DEF%20CON%2033%20presentations/Gabriel%20Gegenhuber%20Maximilian%20G%C3%BCnther%20-%20Silent%20Signals%20Exploiting%20Security%20and%20Privacy%20Side-Channels%20in%20End-to-End%20Encrypted%20Messengers.pdf

Overview

End-to-end encryption (E2EE) is the centerpiece of modern secure messaging. Signal, WhatsApp, and similar applications are built on the premise that even the platform operator cannot read user messages — the cryptographic guarantee is between sender and recipient, and the server merely forwards ciphertext it cannot decrypt. For privacy-sensitive users ranging from journalists and activists to government officials and the general public, this guarantee is foundational.

At DEF CON 33, Gabriel Gegenhuber from the University of Vienna and SBA Research, and his co-researcher Maximilian Günther (also University of Vienna), presented "Silent Signals" — a systematic research program identifying security and privacy side channels in WhatsApp and Signal that leak meaningful information about users without breaking the encryption at all. The research began as Günther's bachelor thesis and escalated, in his words, into discovering vulnerabilities affecting billions of users.

The critical qualifier — and the key insight of the talk — is: your messages being encrypted does not mean your activities, patterns, relationships, and presence are private. The attack surface is everything that happens around the encryption, not through it.

Background

▶ Watch: WhatsApp finding: phone-number-based delivery enables targeted presence probing (0:54)

End-to-End Encryption: What It Protects and What It Doesn't

In E2EE as implemented by WhatsApp and Signal, message content is encrypted using keys that only the communicating parties possess. When a message traverses the platform operator's servers, it is indecipherable to the operator — they are responsible only for routing the encrypted payload to the right destination. This architectural property defeats:

• Server-side surveillance of message content by the platform operator.
• Law enforcement data requests that seek message contents from the platform (absent a vulnerability in the implementation or the device itself).
• Server-side data breach exposure of message content.

What E2EE does not inherently protect includes:

• Metadata: Who communicated with whom, when, how frequently, and from where.
• Behavioral signals: When a user is online, when they are typing, when they last read a message.
• Protocol-level observables: The structure and timing of API calls, the content of non-message protocol exchanges, the presence or absence of push notifications.

The research exploits these non-content observables — side channels that the E2EE architecture explicitly does not attempt to protect — to derive sensitive inferences about users.

Multi-Device Support and Its Complications

A key technical backdrop is the multi-device architecture now standard in both WhatsApp and Signal. Users routinely use WhatsApp Web, desktop Signal, and linked secondary devices alongside their primary smartphone.

Two architectural approaches exist:

Leader-based (used by older WhatsApp implementations): A single "leader" device (typically the smartphone) holds the E2EE keys. Secondary devices synchronize with the leader rather than being independently addressable by external parties. This simplifies key management but creates single points of failure.

Client fan-out (used by Signal and newer WhatsApp): Each device has its own key pair and is independently addressable. When a message is sent, it is individually encrypted for each recipient device. This adds complexity but improves reliability and supports true multi-device messaging without the leader device being present.

From a side-channel perspective, the fan-out model creates new observable signals: the number of devices a user has, how they respond to messages across devices, and synchronization timing patterns.

Key Findings

▶ Watch: Background: how multi-device E2EE creates new side channel surfaces (6:46)

1. Online Presence Inference at Scale

Both WhatsApp and Signal expose some form of "online presence" indicator — the "last seen" timestamp or active status observable to contacts (and in some cases to non-contacts). The research team identified ways to:

• Enumerate online patterns precisely: By sending probes at regular intervals and observing responses, a dedicated observer can map a target user's activity patterns with high temporal resolution — effectively building a behavioral schedule (when they wake up, when they work, when they sleep, across timezones).
• Correlate identities across platforms: If two accounts show highly correlated online patterns, they are likely operated by the same person. This enables cross-platform identity correlation even when users have taken care to use separate phone numbers or accounts.
• Infer social graph structure: By observing when a target comes online in response to a message send event (even without delivering a message directly), the research demonstrated that reactive online signals can reveal who is communicating with whom without any access to message content.

2. Cross-Device Delivery Side Channels

In multi-device messaging architectures, the delivery receipt system — which indicates whether a message has been delivered to the recipient's device — leaks information about the recipient's device configuration:

• Device count inference: In the fan-out model, the timing and structure of delivery acknowledgments from multiple devices can be analyzed to infer how many devices a user has registered. A message delivered to a user with three devices produces a different delivery acknowledgment pattern than one delivered to a user with one device.
• Device type inference: Platform-specific behavior differences (iOS vs. Android push notification handling, battery optimization behaviors, app lifecycle differences) produce subtly different timing patterns in delivery acknowledgments, enabling device type identification.
• Read receipt correlation: In cases where read receipts are enabled, the timing between delivery and read events across devices provides additional behavioral signal.

3. WhatsApp-Specific Vulnerabilities

WhatsApp, with its 3+ billion users, presented the most extensive attack surface:

• Business API interaction side channels: WhatsApp's business messaging API, used extensively for customer service, appointment reminders, and delivery notifications, exposes additional observable signals not present in consumer-to-consumer messaging.
• Group membership inference: The research identified mechanisms by which an observer outside a WhatsApp group could infer membership changes or activity within the group based on observable metadata.
• Profile update propagation timing: When a user updates their profile photo or status, the propagation timing to contacts and near-contacts reveals social graph structure.

4. Signal-Specific Findings

While Signal's threat model is more explicitly privacy-focused and its design reflects stronger metadata protection principles, the research identified:

• Sealed sender limitations: Signal's sealed sender feature is designed to hide the sender identity from the Signal server. The research examined conditions under which this protection is reduced or ineffective.
• Delivery timing signals: The timing of delivery acknowledgments in Signal's multi-device fan-out architecture exposes analogous device count and presence information to what was found in WhatsApp.

Technical Deep Dive

▶ Watch: Technical root cause: fan-out message delivery creates measurable timing oracle (15:48)

Side Channel Taxonomy

The research organized discovered side channels into a taxonomy based on what they leak and how:

Timing channels: The latency between specific events (message send, delivery receipt, read receipt, online status change) encodes information about the recipient's device state, network conditions, and behavior.

Structural channels: The structure of protocol responses — the number of acknowledgments received, the sequence in which they arrive, the presence or absence of specific protocol fields — encodes information about user configuration (number of devices, device types, feature enablement).

Behavioral channels: Aggregate patterns of observable events over time encode information about user identity (activity schedules, response habits) and social graph (who reacts to whom, how quickly).

Presence Probing Methodology

The core technique for online presence inference involves:

1. Establishing a baseline of the target user's observable signals (last seen, online status) over a period of days to weeks.
2. Correlating signal changes with probe events (sending messages, observing reactions without sending) to calibrate the channel.
3. Building a predictive model of the target's activity schedule with statistical confidence intervals.

In practice, this does not require any special access — any WhatsApp user who has the target's phone number can observe "last seen" timestamps (depending on target's privacy settings) and "online" indicators. The novelty is in the systematic exploitation of these signals at scale and the inference of higher-order information from them.

Fan-Out Timing Analysis

For device count and type inference, the methodology involves:

1. Sending a message to the target.
2. Capturing the precise timestamps of each delivery acknowledgment received.
3. Analyzing the distribution of inter-acknowledgment delays.

In the fan-out model, each device independently acknowledges delivery when it receives the push notification and processes the message. Different device types (iOS, Android) have characteristic response time distributions based on their push notification infrastructure (APNs for iOS, FCM for Android), battery optimization policies, and app lifecycle behavior. By fitting observed delay distributions to known device-type profiles, the number and types of devices can be inferred with reasonable accuracy.

Phone Number as Universal Identifier

A critical observation underlining all of the research: the only prerequisite for performing these attacks is possession of the target's phone number. No consent, interaction, or prior relationship is required. This is not a minor technical detail — it means that any actor with access to a list of phone numbers (advertisers, stalkers, intelligence agencies, abusers) can run these side channel attacks against all targets on that list simultaneously, at scale, without detection.

Demo / Proof of Concept

▶ Watch: Online presence inference: bulk probing reveals who is online at what times (20:17)

The team demonstrated:

1. Presence probing tool: An automated tool that, given a phone number, observes WhatsApp online/offline transitions over time and plots the resulting activity heatmap. The demo showed a convincing behavioral profile built from entirely public-facing signals over a 48-hour observation window.

1. Device count inference: A test account with a known device configuration (1, 2, or 3 registered devices) was used as a ground truth. The timing analysis tool correctly inferred device count across multiple test cases.

1. Identity correlation demonstration: Two accounts operated by the same individual showed activity pattern correlations statistically distinguishable from random correlation with high confidence.

The research team noted coordination with Meta (WhatsApp) and Signal's security teams ahead of the public disclosure, consistent with responsible disclosure practices. Both platforms have been notified of the findings.

Defensive Implications

▶ Watch: Severe finding: forced prekey exhaustion strips one layer of forward secrecy (33:44)

For Users

• Disable "last seen" and online status visibility in WhatsApp: Settings → Privacy → Last seen and online → "Nobody." This eliminates the most exploitable presence channel. Note that this also means you cannot see others' last seen status.
• Disable read receipts: Removing read receipts eliminates one timing channel, though delivery receipts remain.
• Minimize WhatsApp registered devices: Reducing the number of linked devices reduces the multi-device timing signal strength.
• Use Signal for high-sensitivity communications: Signal's stronger metadata protection design and sealed sender feature reduce (though do not eliminate) side channel exposure.
• Understand what privacy settings do and don't protect: Privacy settings in these apps protect against casual observation, not against a determined adversary with automated tooling.

For Platform Security Teams

• Rate limit presence probing: Detecting and rate limiting high-frequency queries to presence APIs is a straightforward server-side mitigation that significantly raises the cost of automated enumeration.
• Introduce jitter in delivery acknowledgments: Adding randomized delay to delivery acknowledgments degrades timing-based device inference without meaningfully affecting user experience.
• Decouple delivery acknowledgment from device count: Platforms could implement aggregated acknowledgment (returning a single acknowledgment when any device confirms delivery) rather than per-device responses.
• Strengthen sealed sender implementations: Ensure sealed sender protections are enforced uniformly across device types and protocol paths, not just under ideal conditions.

For High-Risk Users (Journalists, Activists, Government Officials)

• Assume behavioral patterns are observable: Even with maximum privacy settings, a sophisticated observer with your phone number can infer your activity schedule. Structure your communication habits accordingly.
• Use ephemeral phone numbers: For communications that require high anonymity, using a number that cannot be linked to your identity removes the prerequisite for these attacks.
• Consider airgapped communication tools: For the highest sensitivity communications, purpose-built tools that do not rely on consumer messaging infrastructure are warranted.

Key Takeaways

1. E2EE protects message content, not behavioral metadata. The encryption is not broken — the side channels exist entirely outside the encrypted content layer.
2. Phone number possession is sufficient to attack. No interaction, consent, or prior relationship is needed to run these attacks against any WhatsApp user worldwide.
3. Multi-device architectures expand the side channel surface. The fan-out delivery model introduces new timing and structural signals that leak device configuration information.
4. Presence signals are behavioral biometrics. Activity pattern data collected over days or weeks constitutes a behavioral fingerprint that can identify, track, and correlate individuals across platforms.
5. Privacy settings provide incomplete protection. Platform privacy controls can reduce casual exposure but are not designed to defeat systematic, automated side channel analysis.

About the Speakers

Gabriel Gegenhuber is a PhD candidate at the University of Vienna and a security researcher at SBA Research. He specializes in cellular networks and mobile security and has presented research at multiple DEF CON, Black Hat, and academic conferences. His work spans protocol-level analysis of mobile communication systems and the intersection of cryptographic protocol design with practical privacy guarantees.

Maximilian Günther is a master's student at the University of Vienna. This was his first DEF CON appearance, having previously authored research findings as his bachelor thesis under Gegenhuber's supervision. He is also an active bug bounty hunter. His progression from bachelor thesis to DEF CON main stage reflects the research team's assessment that the findings were significant enough to warrant broad public disclosure to the security community.