device-activity-tracker README

The project's README from github.com/gommzystudio/device-activity-tracker. As one markdown file: README.md.

Device Activity Tracker

WhatsApp & Signal Activity Tracker via RTT Analysis

Node.js TypeScript React License MIT

⚠️ DISCLAIMER: Proof-of-concept for educational and security research purposes only. Demonstrates privacy vulnerabilities in WhatsApp and Signal.

Overview

This project implements the research from the paper "Careless Whisper: Exploiting Silent Delivery Receipts to Monitor Users on Mobile Instant Messengers" by Gabriel K. Gegenhuber, Maximilian Günther, Markus Maier, Aljosha Judmayer, Florian Holzbauer, Philipp É. Frenzel, and Johanna Ullrich (University of Vienna & SBA Research).

What it does: By measuring Round-Trip Time (RTT) of WhatsApp message delivery receipts, this tool can detect:

Security implications: This demonstrates a significant privacy vulnerability in messaging apps that can be exploited for surveillance.

Example

WhatsApp Activity Tracker Interface

The web interface shows real-time RTT measurements, device state detection, and activity patterns.

Installation

# Clone repository
git clone https://github.com/gommzystudio/device-activity-tracker.git
cd device-activity-tracker

# Install dependencies
npm install
cd client && npm install && cd ..

Requirements: Node.js 20+, npm, WhatsApp account

Usage

The easiest way to run the application is using Docker:

# Copy environment template
cp .env.example .env

# (Optional) Customize ports in .env file
# BACKEND_PORT=3001
# CLIENT_PORT=3000

# Build and start containers
docker compose up --build

The application will be available at:

To stop the containers:

docker compose down

Manual Setup

Web Interface

# Terminal 1: Start backend
npm run start:server

# Terminal 2: Start frontend
npm run start:client

Open http://localhost:3000, scan QR code with WhatsApp, then enter phone number to track (e.g., 491701234567).

CLI Interface (only WhatsApp)

npm start

Follow prompts to authenticate and enter target number.

Example Output:

╔════════════════════════════════════════════════════════════════╗
║ 🟡 Device Status Update - 09:41:51                             ║
╠════════════════════════════════════════════════════════════════╣
║ JID:        ***********@lid                                    ║
║ Status:     Standby                                            ║
║ RTT:        1104ms                                             ║
║ Avg (3):    1161ms                                             ║
║ Median:     1195ms                                             ║
║ Threshold:  1075ms                                             ║
╚════════════════════════════════════════════════════════════════╝

How It Works

The tracker sends probe messages and measures the Round-Trip Time (RTT) to detect device activity. Two probe methods are available:

Probe Methods

Method Description
Delete (Default) Sends a "delete" request for a non-existent message ID.
Reaction Sends a reaction emoji to a non-existent message ID.

Detection Logic

The time between sending the probe message and receiving the CLIENT ACK (Status 3) is measured as RTT. Device state is detected using a dynamic threshold calculated as 90% of the median RTT: values below the threshold indicate active usage, values above indicate standby mode. Measurements are stored in a history and the median is continuously updated to adapt to different network conditions.

Switching Probe Methods

In the web interface, you can switch between probe methods using the dropdown in the control panel. In CLI mode, the delete method is used by default.

Common Issues

Project Structure

device-activity-tracker/
├── src/
│   ├── tracker.ts         # WhatsApp RTT analysis logic
│   ├── signal-tracker.ts  # Signal RTT analysis logic
│   ├── server.ts          # Backend API server (both platforms)
│   └── index.ts           # CLI interface
├── client/                # React web interface
└── package.json

How to Protect Yourself

The most effective mitigation is to enable “Block unknown account messages” in WhatsApp under Settings → Privacy → Advanced.

This setting may reduce an attacker’s ability to spam probe reactions from unknown numbers, because WhatsApp blocks high-volume messages from unknown accounts. However, WhatsApp does not disclose what “high volume” means, so this does not fully prevent an attacker from sending a significant number of probe reactions before rate-limiting kicks in.

Disabling read receipts helps with regular messages but does not protect against this specific attack. As of December 2025, this vulnerability remains exploitable in WhatsApp and Signal.

⚠️ For research and educational purposes only. Never track people without explicit consent - this may violate privacy laws. Authentication data (auth_info_baileys/) is stored locally and must never be committed to version control.

Citation

Based on research by Gegenhuber et al., University of Vienna & SBA Research:

@inproceedings{gegenhuber2024careless,
  title={Careless Whisper: Exploiting Silent Delivery Receipts to Monitor Users on Mobile Instant Messengers},
  author={Gegenhuber, Gabriel K. and G{\"u}nther, Maximilian and Maier, Markus and Judmayer, Aljosha and Holzbauer, Florian and Frenzel, Philipp {\'E}. and Ullrich, Johanna},
  year={2024},
  organization={University of Vienna, SBA Research}
}

License

MIT License - See LICENSE file.

Built with @whiskeysockets/baileys

Use responsibly. This tool demonstrates real security vulnerabilities that affect millions of users.

Star History

Star History Chart

device-activity-tracker (gommzystudio/device-activity-tracker)

Searching Database…

5.2K ·GitHub
Device-activity-tracker
What is this?This is a proof-of-concept security research tool that monitors WhatsApp and Signal users by measuring the Round-Trip Time (RTT) of message delivery receipts, revealing whether a target's device is actively in use, idle, or offline.
How do I get it running?The quickest way is Docker: run 'docker compose up' to launch both the frontend and backend. For a manual setup you need Node.js 20+ and npm, then open the web interface or CLI, scan a WhatsApp QR code, and enter the target phone number.
Do I need my own WhatsApp account to run this?Yes — you authenticate your own WhatsApp account by scanning a QR code via the @whiskeysockets/baileys library, then enter the target's phone number to start probing. Node.js 20+ and npm are also required.
Does this work on Signal too, or is it WhatsApp-only?The research and disclaimer cover both WhatsApp and Signal, but the shipped CLI interface only supports WhatsApp; Signal probing is driven by a separate 'start:signal-api' script and isn't part of the main CLI flow.
Is it legal to track someone's WhatsApp activity with this?No — the authors explicitly warn this is for research and educational purposes only, that tracking people without explicit consent may violate privacy laws, and that authentication data must never be committed to version control.
How does it actually detect if someone is online or offline?It sends a probe message (by default a delete request for a non-existent message ID) and times how long it takes to get the CLIENT ACK. If the RTT is below a dynamic threshold (90% of the median RTT) the device shows 'Online', above it shows 'Standby', and no ACK at all means 'Offline'.
What's the difference between the Delete and Reaction probe methods?Both ping a non-existent message ID to trigger a delivery receipt without the target noticing: 'Delete' sends a delete request (the default), while 'Reaction' sends an emoji reaction instead; you can switch between them from the web UI's control panel.
Can I protect myself from this kind of tracking?Enabling 'Block unknown account messages' under WhatsApp's Privacy settings can reduce an attacker's ability to spam probe messages from unknown numbers, though WhatsApp doesn't disclose the exact rate-limit threshold, so it's not a complete fix. Turning off read receipts does not protect against this specific attack.
Where does this research come from?It implements the findings of the paper 'Careless Whisper: Exploiting Silent Delivery Receipts to Monitor Users on Mobile Instant Messengers' by Gegenhuber et al. from the University of Vienna and SBA Research.
What are similar projects?vulhub, dirtyfrag, CVE-2026-62911, Shadowbroker, bad_query, FilzaSlop, openclaw, Relapse-Exploit
Which topics is it in?messenger, phone-number, poc, surveillance, tracking, whatsapp, security-research, vulnerability, exploit, hacking, academic-research, cybersecurity
Creator
gommzystudio
Size
0.4 MB
Stars
5.2K
Updated
CommitDec 31
Age
10mo
Commits · 90 Days