Two new WhatsApp settings shrink the attack surface of voice calling
WhatsApp has added two optional calling protections this year that go beyond simple spam suppression. “Silence Unknown Callers” and “Protect IP Address in Calls” both reduce the amount of data and processing a call exposes. They were introduced in June 2023 and October 2023 respectively, with the latter currently rolling out to iOS and Android.
Why calls are a favorite target
Calling software is a well-documented attack vector across the industry. Widely used stacks such as WebRTC and PJSIP have accumulated numerous CVEs over time. The attack surface is large—there are many protocols, and call setup often requires parsing packets from an unknown sender before the recipient accepts. This means a caller can exploit flaws without the victim taking any action, leading to zero-click attacks.
Simply silencing an incoming call on the recipient device does not fix this. The underlying network protocols and message flow remain, so the client still processes attacker-controlled data, potentially loading arbitrary content into memory. In the worst case, the device leaks information back to the attacker to improve exploit reliability.
Attempting to fix this on the device with firewalls, state machines, and sandboxes is also unreliable. Real-world cases, including Pegasus infections and zero-day exploits, show these client-side defenses can fail.
A protocol-level change
Instead of additional client-side hardening, WhatsApp reworked the network flow for silenced call notifications. A dedicated, stripped-down protocol delivers only the notification to the recipient. The server enforces this protocol, protecting the device from the complexity of full call setup and attacker-controlled data.
Designing this server-side required a way for the server to decide whether a call should ring the recipient—without asking them and without learning who they know. In an end-to-end encrypted messenger, clients are the source of truth. WhatsApp deliberately does not maintain logs of who is messaging or calling; the company cites both privacy and security concerns with storing such records for its two billion users.
The solution was a new mechanism called privacy tokens. Each client locally decides which users it trusts and issues tokens to them. When a caller places a call, the request includes the recipient’s token. The server validates the token along with other factors to determine whether the recipient should be rung. The server cannot infer the relationship between the two users from the token itself.
The result is a calling surface that is significantly less attractive to attackers: unknown numbers are filtered before their packets ever reach the recipient’s device in full call form.
Keeping IP metadata out of the call
Most calling products—WhatsApp included, in its standard configuration—use peer-to-peer connections. Direct connections improve quality and reduce latency, but they also reveal the participants’ IP addresses to one another. On a one-to-one call, each side can derive the other’s approximate geographical location and internet service provider.
The “Protect IP Address in Calls” feature changes this by routing the call through WhatsApp’s servers. When enabled, the other parties no longer see your IP address, which prevents them from inferring your location. The relayed calls remain end-to-end encrypted, so the servers carrying them cannot listen to the conversation.
Instructions for enabling the feature are available in the WhatsApp Help Center.
Two layers, one goal
Both features attack different parts of the problem. “Silence Unknown Callers” limits who can trigger the complexity of call setup at all, while “Protect IP Address in Calls” reduces the metadata exposed when a call does happen. Together they expand the privacy controls available to users beyond message-level encryption, addressing both the data a caller can send and the data a recipient leaks back.
