With over 3 billion users globally, mobile instant messaging apps have become indispensable for both personal and professional communication. Besides plain messaging, many services implement additional features such as delivery and read receipts informing a user when a message has successfully reached its target. This paper highlights that delivery receipts can pose significant privacy risks to users. We use specifically crafted messages that trigger delivery receipts allowing any user to be pinged without their knowledge or consent. By using this technique at high frequency, we demonstrate how an attacker could extract private information such as the online and activity status of a victim, e.g., screen on/off. Moreover, we can infer the number of currently active user devices and their operating system, as well as launch resource exhaustion attacks, such as draining a user's battery or data allowance, all without generating any notification on the target side. Due to the widespread adoption of vulnerable messengers (WhatsApp and Signal) and the fact that any user can be targeted simply by knowing their phone number, we argue for a design change to address this issue.

翻译：移动即时通讯应用在全球拥有超过30亿用户，已成为个人与职业沟通不可或缺的工具。除基础消息功能外，许多服务还实现了送达与已读回执等附加功能，以告知用户消息是否成功抵达目标。本文指出，送达回执可能对用户构成重大隐私风险。我们通过精心构造的消息触发送达回执，使得任何用户可在不知情或未同意的情况下被远程探测。通过高频使用该技术，我们展示了攻击者如何提取受害者的在线状态与活动状态（如屏幕开关）等隐私信息。此外，我们能够推断当前活跃用户设备数量及其操作系统，并发动资源耗尽攻击（如耗尽用户电量或数据流量），且所有操作均不会在目标端产生任何通知。鉴于易受攻击的通讯应用（WhatsApp和Signal）的广泛普及，以及仅需知晓电话号码即可锁定任意用户的事实，我们主张通过设计变更来解决此问题。