Video Summary - Hacking '❤️' to Track ANY WhatsApp or Signal User

Scientific concepts / discoveries / nature phenomena presented

Key idea: Even without malware, attackers can exploit delivery receipts generated by WhatsApp/Signal.
How it works (conceptual flow):
- Sender transmits a message → it reaches a WhatsApp/Signal server → sender gets the first check mark.
- When the message actually reaches the recipient → sender gets the second check mark (a delivery receipt).
Core discovery: By measuring the time delay between these events, an attacker can infer sensitive states of the recipient’s device.

Basic state inference: Attackers can distinguish whether the victim phone is:
- Locked vs unlocked
- Whether WhatsApp is open
Method described: Researchers demonstrate repeatedly spamming the victim with reactions (not normal messages).
- Reactions generate delivery receipts but generally do not trigger user notifications, making surveillance more covert.
Invisible/spoofing behavior:
- Using open-source WhatsApp clients, attackers can send reactions to non-existent messages, which the victim device may silently discard without the user realizing they’re being targeted.

WhatsApp: described as having no effective rate limiting, enabling about one reaction every 50 ms (≈ 20 reactions/second).
Signal: described as rate limiting reactions to about one per second, reducing the speed/accuracy of the attack.

Unlike read receipts, the claim is that delivery receipts are integral to app functioning and cannot be turned off.

Phone model fingerprinting: Response times differ slightly between brands (examples given: Apple, Samsung, Xiaomi), allowing rough identification of device type.
Connectivity fingerprinting: Attacker can infer whether the victim is on:
- Wi‑Fi (more predictable ping/latency)
- Cellular (more variable timing)
Activity inference: Concentrated patterns are said to correspond to periods such as when the victim has the app open during a phone call.

Concept: With desktop clients, encryption/read-receipt handling is described as producing device-specific behavior.
Result: An attacker can combine signals across devices to determine which devices are online at different times (e.g., home PC on/off, work laptop on/off), enabling a daily location/activity timeline.

The video claims an attacker could:
1. Use a previous WhatsApp exploit to convert a single face image into a phone number
2. Then apply the delivery-receipt timing method to map habits

If two targets show app-open activity at consistent overlapping times, the attacker can infer likely communication links (e.g., “they’re probably talking to each other”).

Data usage inflation (WhatsApp):
- Spam reactions at high frequency can drive up data consumption (claimed ~13 GB/hour).
- Battery drain described as up to ~18% per hour.
Signal impact: reduced due to rate limiting (claimed ~360 MB/hour).

Signal mitigation: change phone number privacy settings to prevent discovery via phone number.
WhatsApp mitigation: enable a new privacy setting (Advanced) to block high volumes of messages from unknown accounts.
- The video notes uncertainty whether this fully stops the invisible reaction-spam method.

University of Vienna researchers (the video explicitly states the vulnerability was discovered there)
“Careless Whisper” (paper title; attributed to University of Vienna researchers in the video)
DEFCON talk (researchers’ Defcon presentation is mentioned, but no individual name is given)

Note: No individual researchers are named in the provided subtitles; only institutions/paper title are.