Connecting the Dots: An Investigative Study on Linking Private User Data Across Messaging Apps

Connecting the Dots: An Investigative Study on Linking Private User Data Across Messaging Apps

Speakers: Junkyu Kang

Conference: NDSS Symposium

YouTube: https://www.youtube.com/watch?v=c6Fa9Z3DUNk

Overview

Presented by So Lee (on behalf of Junkyu Kang), this collaborative research between KAIST and the University of Maryland demonstrates how privacy attacks that seem minor on individual messaging platforms become devastating when chained across multiple apps. The study evaluates three component-level attacks -- contact discovery abuse, single sign-on token theft, and location inference -- and shows how they can be combined using linking keys (shared identifiers like phone numbers and profile images) to execute end-to-end attacks including de-anonymization of anonymous accounts and targeted physical tracking campaigns. A single Kakao Talk account can perform over 150,000 contact discovery requests per day, and the researchers successfully de-anonymized over 50% of anonymous Telegram accounts by cross-referencing with Kakao Talk. The location inference algorithm reduced required queries from 600+ to just 12 while maintaining comparable accuracy.

Background

▶ Watch: Multi-platform privacy threat: same person across messaging apps (0:30)

Messaging apps are used by billions globally: WhatsApp has approximately 2 billion users, Telegram 950 million, and in South Korea, Kakao Talk reaches 94% of the population. Users commonly maintain accounts across multiple platforms, often using the same phone number but with different privacy postures -- a real name and photo on Kakao Talk for friends and family, an anonymous account on Telegram for private conversations.

Prior research has studied privacy attacks against individual messaging platforms. Contact discovery abuse (submitting phone numbers to discover registered users) was shown feasible in 2015 and remains exploitable in 2021. Location inference attacks exploit proximity features to narrow down user positions. Single sign-on vulnerabilities expose access tokens that enable identity harvesting. However, previous work studied these attacks in isolation, one platform at a time.

Key Findings

▶ Watch: SSO token exposure found on 63 of 14,000 websites (4:00)

Contact discovery still works at massive scale: A single Kakao Talk account can execute over 150,000 requests per day by exploiting delete-friend and block/unblock cycles to bypass rate limits. WhatsApp allows roughly 18,000 and Signal approximately 7,000 queries per day per account. These numbers multiply with additional accounts.

SSO token exposure is exploitable in production: Analysis of 14,000 websites supporting Kakao Talk single sign-on revealed 63 websites where access tokens were exposed on the client side. Using stolen tokens, the researchers obtained user names, profile images, and email addresses via API requests.

Location inference improved by 50x in efficiency: The researchers' one-mile boundary algorithm for Tinder requires only 12 queries (versus 600+ in prior work) to achieve comparable accuracy (~385 meters average error). With 40 queries, accuracy improves further.

Cross-platform de-anonymization works: Using phone numbers as linking keys between anonymous Telegram accounts and identity-rich Kakao Talk accounts, the researchers recovered real names for over 50% of anonymous accounts (and over 70% when cross-referencing with WhatsApp and Signal via Kakao Talk). This high success rate is driven by Kakao Talk's dominance in South Korea.

Targeted tracking campaigns demonstrated: Starting from 5,000 phone numbers, the researchers successfully located two target users in a specific geographic area by chaining contact discovery (Kakao Talk), profile image matching (face embedding comparison), and location inference (Tinder one-mile boundary algorithm), with localization errors of only a few hundred meters.

Technical Deep Dive

▶ Watch: De-anonymization: 50% of anonymous Telegram accounts unmasked (8:00)

The contact discovery bypass exploits address book synchronization mechanisms. Apps impose daily limits on new contact registrations, but deleting contacts and using block/unblock cycles resets the registration counter, allowing the attacker to enumerate far beyond the intended limit. The attack uses auto-clickers on Android or macros on PC for automation.

The SSO token theft targets the OAuth flow in Kakao Talk's single sign-on. When a service provider receives an access token from the identity provider, the token should remain server-side. The researchers found 63 out of 14,000 websites where the token was accessible client-side, enabling the attacker to use it directly against Kakao Talk's API to retrieve user profile data.

The location inference algorithm exploits Tinder's "one mile away" proximity display. Rather than traditional trilateration requiring hundreds of position changes, the researchers identify boundary points where the app still reports the target as one mile away, then estimate the center of the resulting boundary circle. Twelve queries suffice for an initial estimate; 40 queries refine it further.

Linking keys connect these individual attacks. Phone numbers are the strongest linking key (used across most messaging platforms). Profile images serve as a secondary linking key using face embedding comparison -- even when users do not use identical photos, facial recognition can match the same person across platforms.

Demo / Proof of Concept

▶ Watch: Targeted tracking: locating users within hundreds of meters (10:00)

The researchers demonstrated two end-to-end attack chains. First, de-anonymization: starting with 1,000 random phone numbers, they found 88 Telegram profiles (40 anonymous), then recovered real names via Kakao Talk for over half. Second, targeted tracking: from 5,000 phone numbers, they identified Kakao Talk profiles (3,000 candidates), computed face embeddings, searched a target area on Tinder using grid-based scanning, matched profiles via embeddings, and localized two targets to within a few hundred meters using the one-mile boundary algorithm.

Defensive Implications

▶ Watch: Key takeaway: privacy fails by composition across apps (13:30)

The researchers propose several mitigations. For contact discovery, query throttling (fewer than 100 registrations per day) helps but can be bypassed with multiple accounts. A more robust defense leverages social circle analysis: real users' address books exhibit meaningful social connections (24% probability that two random contacts know each other), while adversarial address books contain random, unconnected numbers. Sampling two groups of 10 contacts, the probability of observing at least one real friendship is 99%, enabling detection of malicious enumeration attempts.

For location privacy, increasing grid snapping size on platforms like Tinder improves privacy but reduces usability. For SSO token exposure, implementing mutual TLS allows API endpoints to verify that token-based requests originate from authorized services, blocking attacker-initiated requests.

Key Takeaways

• Privacy attacks that seem minor on individual platforms become devastating when chained across multiple messaging apps using shared identifiers
• A single Kakao Talk account can perform 150,000+ contact discovery requests per day by exploiting rate limit bypasses
• Over 50% of anonymous Telegram accounts can be de-anonymized by cross-referencing with Kakao Talk in South Korea
• Location inference improved from 600+ queries to 12 while maintaining comparable accuracy on Tinder
• Countries with a single dominant messaging platform face amplified cross-platform privacy risk
• Social circle analysis can distinguish malicious contact discovery from legitimate address book syncing

About the Speaker(s)

So Lee presented on behalf of Junkyu Kang. The research is a collaboration between KAIST (Korea Advanced Institute of Science and Technology) and the University of Maryland, focusing on cross-platform privacy threats in the messaging ecosystem.