Device Linking Feature Abused by German Authorities to Eavesdrop on Encrypted Messages
German law enforcement is exploiting the device linking feature in popular messaging apps like WhatsApp and Signal to access user communications without breaking end-to-end encryption.
Law enforcement agencies in Germany have reportedly begun leveraging the device linking functionality present in widely-used messaging applications such as WhatsApp and Signal to gain access to user messages. This technique circumvents the need to crack the end-to-end encryption that secures these communications.
The method involves connecting a police-controlled computer to a suspect's messaging account. Once established, messages sent to and from the suspect's account are then delivered to this connected police device. This effectively allows authorities to read messages in near real-time, as if they were the intended recipient.
According to Netzpolitik, German authorities are able to establish this connection through several means. One common method involves gaining physical access to the suspect's primary device, such as their smartphone, to initiate the linking process. Alternatively, they may intercept verification codes, potentially through state-sanctioned phishing attacks or by leveraging broader telephone surveillance capabilities to capture SMS messages containing these codes.
While this tactic does not break the underlying encryption protocols of apps like WhatsApp and Signal, it exploits a feature designed for user convenience. The device linking functionality allows users to seamlessly use their messaging accounts across multiple devices, such as a phone and a desktop computer, by verifying the connection with a code or QR scan from the primary device.
The effectiveness of this eavesdropping method hinges on the user's awareness and the security of their primary device and verification channels. The article highlights that this process requires some form of user consent, even if that consent is obtained through deceptive or coercive means.
To counter this emerging surveillance technique, the article suggests a crucial addition to messaging applications: a feature that clearly displays all currently linked devices associated with an account. Such a notification system would empower users to identify and potentially revoke unauthorized connections, thereby safeguarding their privacy.
This exploitation underscores a growing challenge in digital privacy: the misuse of legitimate features for surveillance purposes. As messaging apps continue to integrate cross-device functionalities, the potential for such abuses increases, necessitating proactive security measures from both developers and users.
The implications extend beyond Germany, as similar tactics could be adopted by law enforcement in other jurisdictions if messaging applications do not implement robust user-facing controls for managing linked devices.