WhatsApp's Deduplication System leaks the common origin and first-sent timestamp of a sent or received media (images, videos, documents, stickers), even if there are various chat hops in the middle.
The reason for this leak is a combination of the E2EE media system and the Server deduplication system WhatsApp uses. Basically, each media piece contains a mediaKey (decryption key) and a mediaKeyTimestamp, to decrypt the server's URL for a media, but because WhatsApp generally tries to avoid uploading the same fileHash twice, this generated mediaKey and mediaKeyTimestamp are reused by all the users in a media sending-chain.
This allows to see the original upload of the media and to check common mediaKeys for various media messages.
Further information about the system and its possible exploitation are in the repo's white-paper.
alejandrocora•20m ago
The reason for this leak is a combination of the E2EE media system and the Server deduplication system WhatsApp uses. Basically, each media piece contains a mediaKey (decryption key) and a mediaKeyTimestamp, to decrypt the server's URL for a media, but because WhatsApp generally tries to avoid uploading the same fileHash twice, this generated mediaKey and mediaKeyTimestamp are reused by all the users in a media sending-chain.
This allows to see the original upload of the media and to check common mediaKeys for various media messages.
Further information about the system and its possible exploitation are in the repo's white-paper.