Eavesdropping on WhatsApp and Signal via Device Linking

A feature meant to make messengers more convenient turns out to be equally convenient for anyone who wants to read someone else's chats. Modern apps let you link a phone account to a computer: WhatsApp Web and Signal Desktop let you use your account from a laptop or desktop. That very mechanism is now being used for surveillance.

According to Netzpolitik, Germany's Customs Office connects a police-controlled computer to a suspect's account. Once the link is established, messages start being delivered to that computer as well — with no need to crack the encryption protecting them. End-to-end encryption stays intact; investigators simply become one more "legitimate" recipient.

How access is obtained

There are several ways to attach someone else's account. The first is physical access to the phone: briefly getting hold of the device is enough. The others rely on intercepting the verification code — either through a state-sanctioned phishing attack or by intercepting SMS as part of telephone surveillance.

Here lies a detail Bruce Schneier flags: linking a new device requires the user's consent. In other words, the attack does not bypass the app's safeguards but works through them — tricking or coercing the owner (or the phone itself) into approving the link.

What could help

The obvious defense Schneier describes is a feature that displays connected devices, so a user would notice a new one appear. As the blog's commenters point out, both Signal and WhatsApp already offer this: a full list of linked devices with a "last active" timestamp and an option to remove the link. The real question is whether ordinary users ever check it — because when the encryption itself need not be broken, the owner's vigilance is the last line of defense.

Source: Schneier on Security