The tactic: spying through the back door
The principle is alarmingly simple and exploits a feature that messaging services originally introduced for users’ convenience: linking additional devices (through WhatsApp Web, for example). Once someone gains physical access to your unlocked smartphone for just a few seconds, they can link another device – such as a PC or tablet – to your account using a QR code or a verification code sent by SMS. Investigating authorities already use this tactic during questioning when people voluntarily hand over their smartphones. But the threat does not just come from the authorities: a jealous partner on the sofa in the evening or your boss at the office can also take advantage of a moment’s inattention for a quick bit of ‘ghost pairing’. The devastating consequences of linking a device in this way:
- Real-time surveillance: The attacker sees every new message you send or receive on their own screen at the same time.
- Syncing old chats: Depending on the messaging service, existing chat histories may also be downloaded to the third party’s device when it is linked.
- Undetected tampering: A linked device not only allows someone to read your messages, but often also to compose and send messages from your account, completely compromising the evidential value of chats when it matters most.
Why encryption fails here
Even the best end-to-end encryption offers no protection against this method. To the system, the attacker’s device is not an unauthorised third party, but an official secondary channel that you have authorised. The security mechanism is therefore not cracked, but simply bypassed through legitimate means. Checking the active sessions in the app settings will expose the intrusion, but let’s be honest: who checks that list every day? That is exactly what snoopers are counting on. Often, someone secretly reading your messages will go unnoticed for hours, days or even weeks.
The business risk: shadow IT and industrial espionage
For businesses, this problem becomes dramatically more serious. When employees exchange internal business information, customer data or project details through personal or inadequately secured messaging channels, companies risk substantial data leaks:
- Loss of trade secrets: A device linked without anyone noticing can allow sensitive discussions to reach competitors or unauthorised third parties directly.
- Compliance and GDPR breaches: Synchronising business chats to third-party personal devices without encryption violates applicable data protection rules and can have costly legal consequences for businesses.
How to protect yourself effectively
(Everyday security rules)
As your IT partner, we strongly urge businesses and individuals to make the following security rules part of their daily routine:
- Check linked devices regularly: In your apps (WhatsApp, Telegram, Signal), go to Settings and check ‘Linked Devices’ or ‘Sessions’. Immediately remove any device you are not absolutely certain you set up yourself.
- Secure your lock screen: Never leave your smartphone unattended and unlocked, whether at home or at work. Use strong PINs, Face-ID or fingerprint locks.
- Enable the app lock: Many messaging apps offer an option in their privacy settings to add another layer of protection to the app itself using a separate code or biometric authentication. Enable this feature!
- Be careful with SMS codes: Never share verification codes sent to you by SMS, and be vigilant about who can see your screen.
- Set clear workplace messaging policies: Use only dedicated business messaging apps approved by your IT service provider for business communications, and prohibit the sharing of business data via chat apps intended solely for personal use.
Digital privacy starts with being mindful of how you use your devices. If you need help securing your business communications or setting up secure communication channels for your employees, we are always on hand as your IT service provider to offer advice.
Write here …