“MMS Fingerprint” refers to a reported way of identifying a target phone from the network request it makes to retrieve an MMS. In a 2024 technical account, Enea researcher Cathal McDaid reproduced a flow that exposed a handset’s MMS UserAgent and x-wap-profile fields. Those details can help profile a device, but the test does not show that the technique itself installs spyware or takes over a phone.
What is an MMS fingerprint attack?
The name appeared in a 2015 contract between an NSO Group reseller and Ghana’s telecom regulator, submitted as an exhibit in the WhatsApp–NSO litigation. Enea says the contract described “MMS Fingerprint” as a capability for identifying a target device and operating system without user interaction. The original exhibit is not directly available in the reporting reviewed here, so that description is attributed to Enea and contemporaneous coverage rather than treated as an independently verified technical specification.
In February 2024, Enea published a technical account by Cathal McDaid explaining how a related MMS notification flow could reveal handset details. Enea’s test supports the feasibility of fingerprinting through that flow; it does not establish that NSO used the exact tested implementation in an operation.
How the MMS notification can expose phone details
- A binary SMS, also called a WSP Push notification in this context, tells a handset that an MMS is waiting and includes a content-location URL.
- If the handset retrieves the message, it sends an HTTP GET request to that URL.
- In Enea’s test, the request sent to a server under its control included an MMS UserAgent and an x-wap-profile field.
The UserAgent may identify a device and operating system. The x-wap-profile field refers to a handset capability profile. Together, such information can help an attacker choose a more suitable later exploit or tailor a phishing lure. McDaid described the protocol wrinkle as: “Confusingly, sometimes the MMS flow is not using MMS.” He was referring to the notification-and-retrieval path: an SMS-based notification can prompt a subsequent HTTP request.
#1 Best Overall
- Crime Scene Analysis: Innovating Science's forensic chemistry kit lets learners compare crime scene hair samples with those of four known suspects. This exercise mirrors professional forensic techniques, enhancing analytical skills
- Animal vs. Human Hair: The kit provides samples of deer, cat, and human hair, allowing for comprehensive forensic comparison. This enables learners to source diverse evidence without additional resources
- Differentiate Hair Types: Explore the distinctions between human and animal hair to sharpen forensic investigation skills. Learners gain proficiency in identifying hair origins during analysis
- Hair & Fiber Techniques: Dive into forensic chemistry by learning hair and fiber evidence analysis methods. These skills are crucial for understanding and applying forensic science concepts
- Classroom Ready Kit: Contains materials for 15 groups or 30 students, making it ideal for educational settings. The included teacher's manual and student guide streamline setup and instruction
What the demonstration does—and does not—prove
Enea used sample SIM cards from a western European operator and a server it controlled. The test demonstrated that the handset’s MMS retrieval request could expose the cited fields under those conditions. It is evidence of a workable device-profiling method, not proof of a complete phone compromise.
- Established: Enea reproduced a notification-and-retrieval flow that exposed handset-identifying request fields.
- Not established: The test does not prove that NSO used this exact implementation in a real operation, that this route installed Pegasus, or that the technique was used widely.
- Unknown: Enea reported no observed use in the sources it monitored, but said it could not see every operator worldwide. Its observation is not proof the technique was never used.
The contract dates to 2015. Enea’s authors suggested the method might no longer be in use, but the evidence does not resolve its status across all networks.
Rank #2
- Experiment kit designed to teach students the various techniques used in forensic dentistry while they try and identify the suspect in the case
- Contains eight different activities for exploring the concept of forensic dentistry
- Kit contains enough material for up to 30 student groups, including chemicals, observation sheets, and student exercise copymasters
- Teacher Manual and Student Study guide copymasters are included.
- Perfect experiment for high school chemistry classes
How operators and phone owners can reduce exposure
Enea identifies operator-side filtering as the primary defense because carriers can examine binary SMS/MM1 notifications and associated MMS traffic before it reaches subscribers. Filtering may vary by operator and network; the account does not establish a universal control or guarantee that every carrier blocks this behavior.
For individual users, Enea notes that disabling MMS auto-retrieval may be an additional measure where a handset offers that setting. The availability and location of the option differ by device, operating-system version, carrier, and region, so there is no reliable universal menu path. Turning off automatic retrieval can also affect how legitimate picture messages arrive. A device setting is therefore a supplementary step, not a substitute for network-side filtering.
Rank #3
- 🕵️ SOLVE MYSTERIES LIKE A REAL DETECTIVE: Step into the shoes of a forensic scientist! This complete crime-solving kit lets kids collect and classify fingerprints, dust for latent prints, and create facial composite images using a working projector. Perfect for aspiring detectives and mystery lovers.
- 🔍 EXAMINE & CLASSIFY FINGERPRINTS: Learn the four main fingerprint patterns—arches, loops, whorls, and accidentals. Use the included magnifying lens, ink pad, dusting powder, and brush to collect prints from family and friends, then build your own fingerprint database just like real police departments!
- 🖼️ BUILD FACES WITH THE IDENTIKIT PROJECTOR: Assemble the battery-powered projector (3 AAA batteries required, not included) and mix and match facial features from 8 different slide categories including eyes, ears, hair, nose, mouth, eyebrows, beard, and glasses. Project faces onto any wall to create suspect composites!
- 🔬 COMPLETE FORENSICS LAB IN A BOX: Kit includes fingerprint file cards, collection cards, transparent adhesive tapes, development pad, dusting powder, ink pad, magnifying lens, brush, detective ID card, and all parts to build the Identikit projector with LED light and focusing lens.
- 🎁 PERFECT STEM GIFT FOR AGES 8-12: Ideal for birthdays, homeschool science, or family game night. This educational kit teaches observation skills, pattern recognition, and forensic science principles while providing hours of screen-free detective fun. Adult supervision recommended for dusting powder use.
Enea also reported that the contract documentation warned MMS content might appear on a target device and that an operator could block the feature. Its researchers described altering a test notification to a silent SMS, while noting that such traffic could be more conspicuous to operator filtering. These are reported observations, not assurances about how every phone or network will behave.
Quick Recap
Rank #4
- 🎆 Headspace Analysis: Affordable oxygen headspace analysis with a high quality electrochemical sensor. USA NIST traceable calibrated in Los Angeles.
- 🌈 COLOR DISPLAY: Color screen and Graph functions. Computer Data Logging.
- 📲 BATTERY: USB recharge and light handheld instrument. Arrives with syringes, filters, luer lock connectors and 100 septa.
- 💪 STRONG: Robust design made of high strength ABS and Anti-slip grip rubber. Waterproof, dust-proof and explosion-proof.
- 🕵️ TRUST: ** 1 year limited warranty ** Arrives with calibration and QA certificate ** 100% product test and verification in the USA ** 100% quality guaranteed **
Network filtering versus disabling auto-retrieval
| Measure | Coverage and dependency | Trade-off |
|---|---|---|
| Operator-side filtering | Applied at the network level; depends on the operator’s controls and traffic handling. | Can address traffic before it reaches individual handsets, but operator behavior varies. |
| Disable MMS auto-retrieval | Applies only on devices that offer the setting and only to that handset’s retrieval behavior. | May reduce automatic retrieval, but can delay or change delivery of legitimate MMS; it is not a universal block. |
Sources
- Enea, Cathal McDaid, “Dusting Off Old Fingerprints: NSO Group’s Unknown MMS Hack,” February 15, 2024 — technical explanation, reproduction, and mitigation discussion.
- SecurityWeek, Kevin Townsend, “Mysterious ‘MMS Fingerprint’ Hack Used by Spyware Firm NSO Group Revealed,” February 16, 2024 — contemporaneous reporting on the contract claim and Enea’s account.
- Dark Reading, Jai Vijayan, “NSO Group Adds ‘MMS Fingerprinting’ Zero-Click Attack to Spyware Arsenal,” February 19, 2024 — additional coverage of the reported exhibit and test.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
