Device Activity Tracker is a proof-of-concept tool that demonstrates privacy vulnerabilities in WhatsApp and Signal by inferring device activity states from message delivery timing.
The tool exploits a privacy leak in how messaging applications handle delivery receipts. By sending probe messages and measuring the round-trip time of acknowledgments, it can detect whether a target device is actively in use, in standby mode, or offline. The approach works by analyzing the CLIENT ACK response time to probe messages, using a dynamic threshold calculated from median RTT values to classify device states. Two probe methods are available: sending delete requests or reaction emojis to non-existent message IDs, both of which trigger server responses without alerting the target user.
This is explicitly a proof-of-concept for security research and educational purposes, implementing research from academic work on messaging application vulnerabilities. Potential adopters should understand that this tool is designed to demonstrate a surveillance capability rather than solve a practical problem. It suits security researchers, privacy advocates, and developers studying messaging application vulnerabilities. The project includes both a web interface for real-time monitoring and a command-line interface, with Docker deployment available for ease of setup.
The project shows active development with implementations across multiple technology layers: a Node.js backend using the Baileys library for WhatsApp integration, a React frontend for visualization, and TypeScript throughout for type safety. The codebase demonstrates attention to practical deployment concerns through Docker support and configurable port settings. The tool includes adaptive threshold logic that adjusts to different network conditions rather than using fixed timing values, suggesting iterative refinement based on real-world testing scenarios.
