AI
How Client Fan-Out Makes Multi-Device E2E Encryption Possible
WhatsApp moved from a leader-based architecture to client fan-out in 2021. In client fan-out, every device holds its own encryption keys. When Alice sends a message to Bob, who has three devices, she encrypts it separately for each one and sends four copies total (including to her own companion device). Signal uses the same scheme. This design makes multi-device E2E messaging possible, but each device’s key bundle becomes a queryable artifact that leaks information.
Silent Pings via Reaction Messages
The researchers needed silent probing: messages that trigger a delivery receipt without showing a notification on the target’s screen. Editing and reaction messages generate delivery receipts at the protocol level, but the UI never shows the double checkmark. Reactions sent to non-existent message IDs are fully invisible, with no alert at the target. The same technique, run at high volume, drained a standby phone’s battery at 18% per hour and consumed 13 GB of data per hour, with WhatsApp enforcing no rate limits on reactions.
Inferring Device State from Receipt Timing
The roundtrip time of a delivery receipt changes with the target device’s state. On an iPhone, standby sits at roughly 1,500 ms. Screen-on drops below 1,000 ms. WhatsApp in the foreground drops below 500 ms. This held for Android, though Samsung required a 30-second probe interval to avoid keeping the device awake. WhatsApp had no rate limiting. Signal capped at one probe per 2 seconds. Live tracking of a colleague’s commute showed when a home workstation went offline and a work laptop logged into the office Wi-Fi.
Draining One-Time Prekeys to Track Device Presence
WhatsApp uses three distinct key types per device. The identity key is static. The signed prekey rotates every 30 days. The one-time prekey is single-use, consumed when a new conversation starts. Günther built a client that repeatedly requests prekey bundles, draining one-time prekeys faster than the device could replenish them. By watching when the server stopped returning one-time prekeys, an attacker tracks when a device went offline. Prekey refill speed also varied by OS, with iPhones far slower to replenish than Android devices.
PFS Downgrade and Conversation Denial of Service
When one-time prekeys are exhausted, new conversations fall back to identity key and signed prekey only. This strips one layer of the key hierarchy and weakens perfect forward secrecy. The victim gets no warning. A heavier attack floods the server with prekey requests at a rate that breaks server-side synchronization. At that point, anyone trying to reach the target gets a stuck clock icon and cannot send messages or start calls. The attack worked live in a demo: Ellis could message others normally but could not reach Bob until the attacker stopped and she restarted WhatsApp.
Mitigations and Disclosure
Both reports were filed 11 months before DEF CON 33. WhatsApp forwarded Gabriel’s report in September 2024 and sent no further response until two days before the talk. Signal never replied. Meta closed Max’s prekey report on March 30, 2025, flagging it as a duplicate. Recommended fixes: rate limiting on WhatsApp, randomizing delivery receipt timing by a few seconds, client-side validation for malformed messages, and a visible indicator when a conversation falls back to weaker key parameters.
Notable Quotes
So that’s that’s pretty creepy Gabriel Gegenhuber · ▶ 24:04
server does all the dirty work for us. Maximilian Günther · ▶ 28:58
is basically a PFS downgrade. So perfect Maximilian Günther · ▶ 30:38
still were able to find some bugs. Gabriel Gegenhuber · ▶ 39:50
Key Takeaways
- Any WhatsApp or Signal user can be silently probed using only a phone number, no interaction required.
- Delivery receipt roundtrip time leaks whether a target device is in standby or actively used.
- Draining a target’s one-time prekeys lets an attacker block all new incoming messages to that account.
- Prekey exhaustion triggers a silent PFS downgrade, with no visible warning shown to the victim.
- WhatsApp’s lack of rate limiting lets an attacker drain 18% battery and 13 GB of mobile data per hour.
About the Speaker(s)
Gabriel Gegenhuber is a PhD candidate at the University of Vienna, Austria. He holds a bachelor’s degree in Software and Information Engineering and a master’s degree in Software Engineering and Internet Computing from TU Wien. His research covers cellular and mobile networks, including Internet measurement technologies, traffic classification systems such as deep packet inspection, and technical measures for detecting net neutrality and privacy violations. He also works on the MobileAtlas measurement platform for cellular networks.
Maximilian Günther is a master’s student at the University of Vienna. He works part-time as a full stack engineer at Intigriti and previously served as a security analyst at Austrian Power Grid and as a security researcher with the Austrian Armed Forces.