Whatsapp Network Forensics: Decrypting and Understanding the Whatsapp Call Signaling Messages
Total Page:16
File Type:pdf, Size:1020Kb
Digital Investigation xxx (2015) 1e9 Contents lists available at ScienceDirect Digital Investigation journal homepage: www.elsevier.com/locate/diin WhatsApp network forensics: Decrypting and understanding the WhatsApp call signaling messages * F. Karpisek a, I. Baggili b, , F. Breitinger b a Faculty of Information Technology, Brno University of Technology, Czech Republic b Cyber Forensics Research & Education Group, Tagliatela College of Engineering, ECECS, University of New Haven, 300 Boston Post Rd., West Haven, CT, 06516, USA article info abstract Article history: WhatsApp is a widely adopted mobile messaging application with over 800 million users. Received 10 July 2015 Recently, a calling feature was added to the application and no comprehensive digital Received in revised form 17 September 2015 forensic analysis has been performed with regards to this feature at the time of writing this Accepted 19 September 2015 paper. In this work, we describe how we were able to decrypt the network traffic and Available online xxxx obtain forensic artifacts that relate to this new calling feature which included the: a) WhatsApp phone numbers, b) WhatsApp server IPs, c) WhatsApp audio codec (Opus), d) Keywords: WhatsApp call duration, and e) WhatsApp's call termination. We explain the methods and WhatsApp fi fi Reverse engineering tools used to decrypt the traf c as well as thoroughly elaborate on our ndings with Proprietary protocol respect to the WhatsApp signaling messages. Furthermore, we also provide the commu- Signaling protocols nity with a tool that helps in the visualization of the WhatsApp protocol messages. Network forensics © 2015 Elsevier Ltd. All rights reserved. Decryption Mobile forensics Digital forensics Cyber security Audio encoding Introduction investigation, making the artifacts it produces of compel- ling forensic relevance. Therefore, we see a strong necessity WhatsApp is one of the most widely used personal- for both researchers and practitioners to gain a compre- messaging mobile applications for free texting and con- hensive understanding of the networking protocol used in tent sharing (namely audio, video, images, location and WhatsApp, as well as the type of forensically relevant data contacts), boasting over 800 million users worldwide and it contains. Most importantly, due to the newly introduced was bought by facebook in 2014 for $19 Billion.1 The calling calling feature, it becomes essential to understand the feature was added recently in version 2.11.552, which was signaling messages used in the establishment of calls be- released 2015-03-05 (Arce, 2015). tween the WhatsApp clients and servers. The methods and From its wide adoption, it is obvious how WhastApp tools used in this research could be relevant to in- communication exchanges may be used during an vestigations where proving that a call was made at a certain date and time is necessary. Our contribution outlines the WhatsApp messaging * Corresponding author. protocol from a networking perspective and provides a fi E-mail addresses: xkarpi03@stud. t.vutbr.cz (F. Karpisek), IBaggili@ solution to explore and study WhatsApp network com- newhaven.edu (I. Baggili), [email protected] (F. Breitinger). munications. In terms of novelty, to our knowledge, this is URL: http://www.unhcfreg.com/, http://www.FBreitinger.de/ fi 1 http://money.cnn.com/2014/02/19/technology/social/facebook- the rst paper that discusses the WhatsApp signaling whatsapp/, last accessed 2015-07-03. messages used when establishing voice calls. The work has http://dx.doi.org/10.1016/j.diin.2015.09.002 1742-2876/© 2015 Elsevier Ltd. All rights reserved. Please cite this article in press as: Karpisek F, et al., WhatsApp network forensics: Decrypting and understanding the WhatsApp call signaling messages, Digital Investigation (2015), http://dx.doi.org/10.1016/j.diin.2015.09.002 2 F. Karpisek et al. / Digital Investigation xxx (2015) 1e9 impact on practitioners in the field that have obtained WhatsApp. In their work, they focused on unencrypted network traffic for a potential suspect, as well as providing traffic that could be easily reconstructed. WhatsApp was scientists literature for better understanding the network found to be favorable at encrypting its network traffic when protocol itself. compared to other mobile social-messaging applications. The rest of the paper is organized as follows. In Section Therefore, based on the primarily findings by Walnycky Related work we review existing work, while Section et al. (2015), our study aimed at further investigating and WhatsApp protocol describes the WhatsApp protocol. dissecting the WhatsApp protocol, and in specific, focusing Then, in Section Tool for visualizing WhatsApp protocol on the signaling messages used when establishing What- messages we describe the tool we created for visualizing sApp calls given this new feature. However, in order to dive exchanged WhatsApp messages. In Section Decryption,we deeper into the signaling messages, one must understand describe the process of obtaining decrypted connections some known attributes of the WhatsApp protocol which between the WhatsApp client and the WhatsApp server. we discuss in Section WhatsApp protocol below. Then in Section Findings we examine the message contents and discuss the meaning of the signaling messages during a WhatsApp protocol WhatsApp call. Finally, in Section Conclusions, we offer concluding remarks and outline some future research. WhatsApp uses the FunXMPP protocol for message ex- change which is a binary-efficient encoded Extensible Related work Messaging and Presence Protocol (XMPP) (WHAnonymous, 2015c). The WhatsApp protocol is also briefly described by There has been research conducted on the forensics of LowLevel-Studios (2012) from an implementation perspec- WhatsApp but the majority of that work focused on the tive. To fully describe the FunXMPP protocol is beyond this data that WhatsApp stores on the mobile device when paper's scope. For more information on the protocol the compared to our work which focuses on the network fo- readers may want visit a website outlining the protocol.2 rensics of WhatsApp. Authentication procedure Network protocol forensics There are two types of authentication procedures the At the time of writing this paper, the work on network WhatsApp client can use when connecting to the servers. If protocol forensics of WhatsApp was sparse. The only work it is the first time the client is connecting to the server, a full that provided any detail on WhatsApp's networking pro- handshake is performed as illustrated in Fig. 1. Subse- tocol was the Hancke (2015) report. Hancke (2015)'s work quently, for any consecutive connections, only a half focused more on Realtime Transport Protocol (RTP) media handshake is executed using data provided from the initial streams (Schulzrinne et al., 2003). The report fails to un- full handshake. cover the call signaling messages used by WhatsApp, which We note that a half handshake therefore results in using is elaborated on by our work. the same session keys multiple times, which can be deemed as a plausible protocol security weakness. Mobile device forensics Full handshake Anglano (2014) performed an in-depth analysis of The authentication procedure as described by the de- WhatsApp on Android devices. The work provided a velopers of WhatsAPI consists of three messages comprehensive description of the artifacts generated by (WHAnonymous, 2015a). This is synonymous with the well WhatsApp and discussed the decoding, interpretation and known three-way handshake and is described in detail in relationship between the artifacts. Anglano (2014) was able the following paragraphs. These messages can be observed to provide an analyst with the means of reconstructing the in Fig. 1 which was created using our developed tool (for list of contacts and chronology of the messages that have more details see Section Tool for visualizing WhatsApp been exchanged by users. protocol messages). The works by Thakur (2013) and Mahajan et al. (2013) are As shown in Fig. 1, first, the client sends an <auth> similar to previous studies since they both focused on the message to the server. This message is not encrypted and forensic analysis of WhatsApp on Android. These studies contains the client number and authentication method the uncovered the forensic acquisition of the artifacts left by client wants to use. WhatsApp on the device. Thakur (2013) focused on the Then, the server replies with a <challenge> message forensic analysis of WhatsAppartifacts on an Android phone's containing a 20 byte long nonce for the session key gener- storage and volatile memory. The results showed that one is ation. Session keys are then generated using the Password- able to obtain many artifacts such as phone numbers, mes- Based Key Derivation Function 2 (PBKDF2) algorithm using fi fi sages, media les, locations, pro le pictures, logs and more. the password as a passphrase and the nonce as a salt. Both Mahajan et al. (2013) analyzed WhatsApp and Viber artifacts the server and the client know the password and nonce so using the Cellebrite Forensic Extraction Device (UFED) toolkit. the generated keys are the same on both ends. Four keys are They were able to recover contact lists, exchanged messages and media including their timestamps and call details. Walnycky et al. (2015) examined 20 different popular 2 https://github.com/WHAnonymous/Chat-API/wiki/FunXMPP- mobile social-messaging applications for Android including Protocol, last accessed 2015-07-03.