Big Tech's 'Secure' Apps Are Spying On You And They Can't Fix It

Your favorite secure messaging apps might be quietly broadcasting your daily routine to anyone with a phone number and a grudge. Security researchers at the University of Vienna have exposed a fundamental flaw in WhatsApp and Signal that enables precise location tracking using nothing more than your phone number. And here's the kicker: the tech giants admit they can't patch it.

I spoke with Max Guenther, the lead security researcher at the University of Vienna, about his team's findings, the mechanics behind this unpatched flaw, and why popular messaging platforms are uniquely vulnerable to this invisible threat.

How a Single Check Mark Secretly Broadcasts Your Location

To deliver a message, your phone needs confirmation that your text actually reached its destination. You've likely seen the check marks that pop up after hitting send. On apps like WhatsApp and Signal, one check mark means your message reached the server, while a second check mark appears the moment it hits the recipient's device. The split-second delay between hitting send and receiving the delivery confirmation is known as the Round-Trip Time (RTT). That tiny gap is where the vulnerability lies.

Unlike a read receipt, which only fires when a message is manually opened, a delivery receipt triggers automatically, even if the incoming text is filtered straight to a spam folder. By simply measuring how long it takes that invisible receipt to return, an attacker can harvest a surprising amount of data about your device, habits, and location.

We just need their phone number. This is basically as invisible as it can be.

Carrying out the attack requires no specialized hardware or insider knowledge. Just a basic script to analyze RTT trends, tools that are already publicly accessible on platforms like GitHub.

As Guenther points out, even microscopic timing variations tell a story: We get a response from the target back, and we can measure the time in between. We can measure the time it takes for the receipt to come to us, and it is shorter, for example, when the device is unlocked or being used right now than when it's in standby or just in locked mode.

Over time, these split-second data points paint a surprisingly vivid picture. By analyzing RTT patterns, an attacker can deduce whether you're actively using your phone, estimate your approximate location, and identify static networks. A work phone connected to office Wi-Fi, for instance, produces an ultra-consistent RTT compared with a personal phone switching between cellular towers. That gives bad actors an invisible tool for continuous surveillance.

The Dilemma: Core Delivery Features Prevent a Full Patch

Guenther and his fellow researchers reported the vulnerability to both WhatsApp and Signal. They detailed their full findings in two papers, Careless Whisper and Prekey Pogo, and each platform acknowledged the vulnerability. Meta awarded a $7,000 payout for the find, while Signal couldn't offer any compensation as a nonprofit organization.

The problem is that these vulnerabilities cannot be fixed.

Delivery receipts provide a core function across all SMS platforms, making complete remediation impossible in the short term. Meta and Signal looked into the issue and put preventive measures in place, such as rate limiting, which reduces the frequency at which spam messages can be received, to stop some spam messages from coming through. However, this fix only slows down the attack.

I reached out to Meta and Signal for comment regarding the vulnerability, but did not receive a response from either company. That silence speaks volumes.

Who Is Actually at Risk?

Guenther's research focused solely on WhatsApp and Signal due to their widespread use and robust infrastructure, but these aren't the only apps to watch out for.

I assume all of the messengers, at least like a lot of them, have similar issues because it's a fundamental problem.

Since all platforms rely on delivery receipts, it's likely that the issue exists in some capacity across most SMS platforms.

Luckily, the average user isn't likely to be targeted by such a narrow exploit, which functions like a zero-click attack in that it targets a specific individual or company. You're at higher risk if you're a prominent figure or handle sensitive data. However, the existence of such a widespread security gap carries severe privacy implications. Unless this flaw is addressed, well-funded organizations could exploit it to track dissidents, journalists, activists, and others. Likewise, stalkers and abusers could exploit the threat to keep tabs on victims.

So while you probably don't need to worry about this particular flaw, you should still take steps to protect yourself online. As the research shows, no platform is free of vulnerabilities. The Constitution doesn't guarantee your digital privacy. Only vigilance does.

Frequently Asked Questions

Can hackers track my location through WhatsApp or Signal?

Yes. Security researchers at the University of Vienna demonstrated that attackers can track your approximate location and device activity by measuring the delivery receipt response time, known as Round-Trip Time (RTT), using only your phone number.

Can WhatsApp and Signal fix this security flaw?

No. The vulnerability is rooted in the core delivery receipt system that all messaging platforms rely on. Meta and Signal have implemented rate limiting to slow down attacks, but they cannot fully patch the flaw without breaking fundamental messaging features.

Who is most at risk from this location tracking vulnerability?

Prominent figures, journalists, activists, dissidents, and individuals handling sensitive data are at highest risk. The attack requires targeting a specific phone number, making it a zero-click attack aimed at specific individuals rather than the general public.