device-activity-tracker - A phone number can reveal whether a device is acti

项目说明

<h1 align="center">Device Activity Tracker</h1>
<p align="center">WhatsApp & Signal Activity Tracker via RTT Analysis</p>

<p align="center">
<img src=" alt="Node.js"/>
<img src=" alt="TypeScript"/>
<img src=" alt="React"/>
<img src=" alt="License MIT"/>
</p>

> ⚠️ DISCLAIMER: Proof-of-concept for educational and security research purposes only. Demonstrates privacy in WhatsApp and Signal.

O

This project implements the research from the paper "Careless Whisper: Exploiting Silent Delivery Receipts to Monitor Users on Mobile Instant Messengers" by Gabriel K. Gegenhuber, Maximilian Günther, Markus Maier, Aljosha Judmayer, Florian Holzbauer, Philipp É. Frenzel, and Johanna Ullrich (Uni of & SBA Research).

What it does: By measuring Round-Trip Time (RTT) of WhatsApp message delivery receipts, this 工具 can detect:

Security implications: This demonstrates a significant privacy in messaging apps that can be exploited for sur.

Example

!WhatsApp Activity Tracker Interface

The web interface shows real-time RTT measurements, device state detection, and activity patterns.

Installation

Requirements: Node.js 20+, npm, WhatsApp account

Usage

Docker (Recommended)

The easiest way to run the application is using Docker:

The application will be a at:

To stop the containers:

Manual Setup

#### Web Interface

Open , scan QR 代码 with WhatsApp, then enter phone number to track (e.g., 7).

CLI Interface (only WhatsApp)

Follow prompts to authenticate and enter target number.

Example Output:

How It Works

The tracker sends probe messages and measures the Round-Trip Time (RTT) to detect device activity. Two probe methods are a:

Probe Methods

| Method | Description |
|--------|-----------------------------------------------------------------------------------------------------------------|
| Delete (Default) | Sends a "delete" request for a non-existent message ID. |
| Reaction | Sends a reaction emoji to a non-existent message ID. |

Detection Logic

The time between sending the probe message and receiving the 客户端 ACK (Status 3) is measured as RTT. Device state is detected using a dynamic threshold calculated as 90% of the median RTT: below the threshold indicate acti, abo standby mode. Measurements are stored in a history and the median is continuously updated to adapt to different 网络 conditions.

Switching Probe Methods

In the web interface, you can switch between probe methods using the dropdown in the control panel. In CLI mode, the delete method is used by default.

Common Issues

Project Structure

How to Protect Yourself

The most effecti is to enable “Block unknown account messages” in WhatsApp under
Settings → Privacy → Ad.

This setting may reduce an attacker’s ability to spam probe reactions from unknown numbers, because WhatsApp blocks high- messages from unknown accounts.
However, WhatsApp does not disclose what “high ” means, so this does not fully prevent an attacker from sending a significant number of probe reactions before rate-limiting kicks in.

Disabling read receipts helps with regular messages but does not protect against this specific attack. As of December 2025, this remains exploitable in WhatsApp and Signal.

Ethical & Legal Considerations

⚠️ For research and educational purposes only. Ne people without explicit consent - this may privacy laws. Authentication data (auth_info_baileys/) is stored locally and must never be committed to control.

Citation

Based on research by Gegenhuber et al., Uni of & SBA Research:

License

MIT License - See LICENSE file.

Built with /baileys

---

Use responsibly. This 工具 demonstrates real security that affect millions of users.

Star History

![Star History Chart]()

项目信息

开发语言：TypeScript

Star 数：5155

技术要点

该项目属于黑客技术方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A phone number can reveal whether a device is active, in standby or offline (and more). This PoC demonstrates how delivery receipts + RTT timing leak sensiti patterns. (WhatsApp / Signal)展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。