Google Can Remotely Bypass Your Android Security Passcode

Google can easily hack into any Android devices remotely from Google Plex headquarter if they received any legal order from US Federal.

Hacking into a system without prior knowledge of victim is usually called illegal but in the offence for doing legal purposes it is called investigating, likewise New York District Attorney have recovered an old document that said: “It is legal for Google to hack into any devices based on Android if asked for Crime Investigation Purposes with a legal document”.

According to a document that deals with the encryption of data and its impact on public safety, older versions of the Android operating system can be easily accessed by Google. According to the text, if the company is required by justice, you can bypass the password of users running versions prior to Android 5.0 (Lollipop) and have full access to the device remotely.

Click here to download the document in PDF

Forensic Examiners can bypass passwords in some of these devices using a variety of techniques,” reads the document. However, for a large portion of Android devices, Google can reset the password if there are a mandate and a requirement of justice to investigate particular device. And all this can be done remotely.



Also according to the document, devices equipped with Android version 5.0 or higher can not be accessed remotely due to the full disc encryption – which still can not be enabled by default. Because of this, according to the distribution table of the operating system, it is estimated that at least 74.1% of users are subject to such “serious failure” of security.

Apple have also said that they even can crack the iPhone security panel after several negotiation from FBI – Apple agrees to crack the passcode of iPhone which will lead for the suspect proof for investigation, for Google is not so hard to crack into the passcode or pattern lock security panel but in terms of iPhone devices its quite hard to crack and need some professionals to do it.



Like us on Facebook and subscribe with your email to receive all our latest updates via your inbox!

Read More >>

ISIS’ OPSEC 34-Pages Manual Reveals How It Handles Cybersecurity

After the gruesome Paris attacks, there have been various reports of varied use of Internet by ISIS for propagating its ideology as well as coordinating its deadly terrorist attacks. While some reports state that ISIS used encrypted channels of communication like the PlayStation 4 and Telegram, other reports state that they used plain vanilla unencrypted SMS to communicate with each other and coordinate the attacks.

While the jury be still be divided on this pending the closure of investigations into the Paris attacks, it seems that ISIS does have a OPSEC manual for its members. It turns out ISIS has a 34-page guide to operational security (.pdf), which instructs its cadre to follow a particular set of cyber life.

The manual is in Arabic and offers nitty gritty of using the Internet for terrorist and propaganda operations. While some of it is pretty basic like using HTTPS websites instead of non secure HTTP websites to communicate, there is also a advanced section in the manual.

For example, the first page of the manual tells the ISIS followers “When you enter the network Twitter through the browser always make .1 sure you enter the correct site Twitter.com (https://twitter.com/) and that an encrypted site at the beginning of the link Pal HTTPS, or green tag, and note any marks (error) called or the appearance of a page to the testimony of false requests “acceptance” or conversion for another site requires no .powers or entry on your account.”

The guide is a handy compilation of advice on how to keep communications and location data private, as well as links to dozens of privacy and security applications and services, including the Tor browser, the Tails operating system; Cryptocat, Wickr, and Telegram encrypted chat tools; Hushmail and ProtonMail for email; and RedPhone and Signal for encrypted phone communications.

ISIS does not like Google’s Gmail. The manual notes that Gmail is safe only if used with fake credentials and only on Tor anonymity network. Similarly, the ISIS have a dislike for Android smartphones and iPhone. The manual states that Android and iOS platforms are only secure when communications are routed through Tor.

The manual instructs operatives to disable the GPS tagging feature on their mobile phones to avoid leaking location data when taking photos. The ISIS cadre is advised to use the Mappr app to falsify location data and throw intelligence agencies off their trail.

ISIS’ OPSEC manual also advises against using Instagram because its parent company, Facebook, has a poor track record on privacy, and it warns that mobile communications can be intercepted, even though GSM networks are encrypted. It advises followers to use encrypted phones like Cryptophone or BlackPhone instead.

The ISIS advises its followers against using Dropbox. For documents, it follows the same recommendations that human rights workers, political activists, whistleblowers and reporters follow. It advises its followers to secure their communications and obscure their identity or hide their location. Use of VPN for hiding origin IP is encouraged.
The Manual notes:

“Use the VPN services and prefer to stay away from the American Arab or .1 .services in this area Use the service Freedome (http://www.f- .2 secure.com/en/web/home_global/freedome) of VPN phones for the iPhone from here (https://itunes.apple.com/us/app/f-secure-freedomevpn/id771791010?mt=8) and for Android from (https://play.google.com/store/apps/details? id=com.fsecure.freedome.vpn.security.privacy.android&hl=en)here, a service of the Finnish security company F-Secure which is not free, but a quick control and protect you from spyware and fraudulent websites and so .on Or use application Avast SecureLine! From security company Avast .3 (http://www.avast.com/index) can download application for the iPhone from (https://itunes.apple.com/us/app/secureline-vpn-wifi-security/id793096595? mt=8)here, and for Android from (https://play.google.com/store/apps/details? id=com.avast.android.vpn&hl=en)here, as it can be used for windows systems”

The documents indicate that the terrorist have not only studied these other guides closely, but also keep pace with the news to understand the latest privacy and security vulnerabilities uncovered in apps and software that could change their status on the jihadi greatest-hits list.



Like us on Facebook and subscribe with your email to receive all our latest updates via your inbox!
- TechWorm

Read More >>

Telegram Blocks 78 ‘ISIS-Related’ Channels

Telegram blocks 78 IS-propaganda channels from using its secure and encrypted messaging platform

It has been well known that the ISIS and its supporters use the Telegram App to propagate their ideology. Now the Telegram creators have blocked as many as 78 ISIS affiliated accounts from using its encrypted and secure service.

The Berlin-based Telegram, a popular mobile messaging service app has blocked 78 known ISIS sympathizer accounts from using its technology to communicate and spread propaganda to a wide audience. Telegram, which has been founded by two Russian brothers, Pavel Durov and Nicolay Durov uses strong encryption that makes it all but impossible for security services to intercept private messages between individuals or members of a group.

In a statement released on Wednesday, Telegram said that it has blocked 78 ISIS-related channels that the terrorist group used to spread propaganda and communicate with other members. The group had been using the app for distributing its propaganda material since October, when Telegram introduced a feature letting users broadcast messages to an unlimited number of subscribers.

“We were disturbed to learn that Telegram’s public channels were being used by ISIS to spread their propaganda. We are carefully reviewing all reports sent to us at
abuse@telegram.org and are taking appropriate action to block such channels. As a result, this week alone we blocked 78 ISIS-related channels across 12 languages.
We are also introducing an easier way for our users to report objectionable public content in the upcoming update of Telegram this week.”

Telegram, Russia’s most popular social network site is very famous internationally, where it is used as an alternative to WhatsApp on similar services. It is an ultra-secure way to quickly upload texts and voice messages, and share videos. It says it has 60 million active users. In 2014, the app racked up millions of downloads, following Facebook’s acquisition of WhatsApp. According to its founder, Pavel Durov, who disclosed the stats during TechCrunch Disrupt in September, said that the app sees more than 12 billion messages a day.
According to security researchers, Telegram became the preferred method for Islamic State to broadcast news and share videos of military victories or sermons. The group used Telegram to claim responsibility for the Paris attacks, which left 129 people dead, and the bombing of a Russian airliner over Egypt last month, which killed 224.

According to Alex Kassirer, a counter-terrorism analyst with the New York-based private intelligence firm Flashpoint, said that IS had started using Telegram broadcast channels to send press releases targeted at inspiring and recruiting followers.

Further, Rita Katz, director of Bethesda, Maryland.-based extremist monitoring service SITE Intelligence Group said that some of the dozens of channels set up had 10,000 followers or more. Some of those channels could not be accessed on Wednesday afternoon and a message was displayed saying they were no longer available. She further added that Telegram had appeared to let the jihadists operate without fear of being turned off or traced until Wednesday.

However, Telegram explicitly says on its site that it makes efforts to block Islamic State, which is also known as ISIS.
The company statement stressed that shutting down ISIS channels on the site was not taken to restrict free speech, which it encourages.

“While we do block terrorist (e.g. ISIS-related) bots and channels, we will not block anybody who peacefully expresses alternative opinions,” Telegram said of its actions.

Telegram said the move would only affect public channels and automated response systems called ‘bots.’ Messages between individuals and group chats that can include up to 200 users would not be affected. While the app says it blocked the ISIS-related channels, unfortunately private communications between ISIS members were unaffected by those blocks.


Like us on Facebook and subscribe with your email to receive all our latest updates via your inbox!
Source: Techworm

Read More >>

Facebook Activate Safety Check For Nigeria As Boko Haram Attacks Yola

Facebook again make the ‘Safety Check' tool available on Tuesday 17th for Nigerians. The reason for this was the bombings that occurred in Yola – Adamawa State, that left 32 dead and at least 70 wounded.

The purpose of the tool is to know through the social network, whether people who live in the city are safe – something that should help ease the agony of relatives and reduce the confusion resulting from a tragedy like that. Although no group has assumed authorship of the attacks, local authorities believe they were made by the terrorist group Boko Haram.



The decision of Facebook seems to be a response to criticism that the company received when they activated the tool after the attacks in France without having done the same after several terrorist attacks in the Middle East, Africa and Asia. According to Alex Schultz, vice president of the company’s growth, the tool made its debut in 2011 with the aim of helping victims of natural disasters.



Facebook CEO, Mark Zuckerberg said:

We’ve activated Safety Check again after the bombing in Nigeria this evening.

After the Paris attacks last week, we made the decision to use Safety Check for more tragic events like this going forward. We’re now working quickly to develop criteria for the new policy and determine when and how this service can be most useful.

Unfortunately, these kinds of events are all too common, so I won’t post about all of them. A loss of human life anywhere is a tragedy, and we’re committed to doing our part to help people in more of these situations.

In times like this, it’s important to remind ourselves that despite the alarming frequency of these terrible events, violence is actually at an all-time low in history and continues to decline.

Deaths from war are lower than ever, murder rates are generally dropping around the world, and — although it’s hard to believe — even terrorist attacks are declining.

Please don’t let a small minority of extremists make you pessimistic about our future.

Every member of our community spreads empathy and understanding on a daily basis. We are all connecting the world together. And if we all do our part, then one day there may no longer be attacks like this.

Already Mark said in a text of his own that the company has decided to use the resource in a wider number of tragic events. “We are working quickly to determine when and how the service might be useful,” he said, making it clear that not all occasions that will awaken the use of the tool.

“Please do not let a minority of extremists let you pessimistic about our future,” said the executive, noting that, in a general context, humanity is registering the lowest number in its history in relation to deaths from wars, murders and terrorist attacks. It remains to wait for the status system does not need to be triggered again due to a new genocide or attack with tragic consequences.
#PrayForNigeria #PrayForPeace

Like us on Facebook and subscribe with your email to receive all our latest updates via your inbox!

Read More >>

US Government Websites Especially FBI's Are Easiest To Hack Says Reformed Hacker

FBI’s website is the easiest to hack says hacker who hacked FBI and Home Office from his bedroom

Reformed hacker says that US government websites especially FBI and Home Office are easiest to hack.

You would be surprised to know that one of the easiest sites to hack is of one of the giant law enforcement authority in the world and even more surprising is the fact that it belongs to United States.

This organization is named Federal Bureau of Investigation. FBI is the domestic intelligence and security service of the United States and is America’s primary law enforcement organisation. A 19 year old hacker, Charlton Floate, brought down FBI and Home Office websites from his bedroom.

Speaking to BBC 5 Live Daily, Floate said that hacking FBI and US Home Office websites wasn’t much of a challenge. “It was surprisingly easy to be honest. It took me about 40 or 45 minutes,” he said. “The fact that the Home Office’s website was connected to its internal network was alarming in itself.” He added that even now Home Office is particularly vulnerable. “If you have passport files or something on the computers at the Home Office, they’re completely exploitable to someone who has an internet connection because they’re connected.”

The 19 year old hacker from Solihull was convicted of hacking related crimes by Birmingham Crime Court. The self-styled internet and online marketing guru had previously admitted three charges under the Computer Misuse Act and two of possessing prohibited images to the authorities. Sentencing Floate, Recorder John Steel QC said his actions were “wrong, serious and criminal”. He added that Floate was “highly intelligent” with a deep and clear knowledge of information technology who had taken a lead role in the conspiracy and had recruited others.

He was given an eight-month jail sentence, suspended for 18 months, and and ordered to do 250 hours of community service.
Speaking to BBC 5 Live Daily, the reformed hacker expressed has deep regret at his actions.

“I honestly regret doing that type of thing now. I got caught up in a world that is rather dark, but it gives you a home when you’re not quite happy with real life,” he told the radio station.



Like us on Facebook and subscribe with your email to receive all our latest updates via your inbox! -TechWorm

Read More >>

An Employee Who Discovered The Vulnerability In Chrome Got Rewarded By Google

During PacSec conference in Tokyo at Pwn2Own contest, a security researcher named Guang Gong showed how, through a failure of Google Chrome, you can take full control of the Android operating system. The biggest problem of this threat is the fact that it is large enough to allow a bad intentioned people to invade a smartphone or tablet through access to a single malicious link.

Details of the flaw are not fully disclosed due to security concerns of chrome users. However, Gong said that it takes advantage of JavaScript engine 8v and if any user’s visit to that malicious site then with that malicious link users will be exposed by hackers and device will be fully under controlled by hackers. The reason why the news remain secret is that hackers might start to exploit Chrome users, but soon after the vulnerability discovered the Google team product manager started the developers team on work to solve the vulnerability.

During his demonstration, the researcher was able to break into a Nexus 6 Project Fi and install an application without any kind of direct interaction. As failure uses JavaScript as the basis, it could theoretically be adapted to work with any Android-based smartphone. The control is not only limit with Chrome but also with the storage drives, the gallery and the camera, the hackers can use in this vulnerability.

As a reward for his discovery, Gong won a trip to the CanSecWest conference in 2016 and will likely get a generous prize money awarded by Google. A member of the company was in the presentation in which the failure was exposed and already hinted the company, which is currently working on ways to correct it. Basically, the attack will touch the nerve of JavaScript Engine v8, it is said that this vulnerability will not differ with the Android version users using, all the version of Android having Chrome with an inbuilt JavaScript v8 engine can eliminate the system to hackers hand.

As we have said that an employee got a perfection with respect from the people who known to him, Gong have won a trip to the CanSecWest Security Conference which will be held on 2016 also received bounty which namely calling as bug Bounty from Google, the amount which is not disclosed, after Google Chrome team heard about the vulnerability in Chrome in v8 JavaScript Engle, the team rush to the conference meeting where Gong showing that how this vulnerability works, and soon after that the team congratulate the Bug finder and they rush to the Google Headquarter to recover and fix the vulnerability as quick as possible.

Now the vulnerability is solved by the team and the Google Chrome team head implies thank you note to Gong.



Like us on Facebook and subscribe with your email to receive all our latest updates via your inbox!

Read More >>

Meet OmniRAT, A $25 Tool To Hack Into Windows, OS X And Android Devices

OmniRAT is a “Remote Administration Tool” which can hack into Windows, OS X and Android run devices and it cost only 25 dollars

OmniRAT is a software that lets you hack into computers running on Windows and Mac OS X in addition to hacking Android smartphones and tablets. OmniRAT can can spy on communications, secretly record conversations, snoop on browsing histories and take complete control of a remote device. And its cheap. OmniRAT is available on the dark web underground forums for $25 compared to another notorious malware, DroidJack which is sold for $210.

Security researcher Nikolaos Chrysaidos from anti-virus maker Avast who discovered the OmniRAT and calls it a “Remote Administration Tool”. In his blog post, Chrysaidos describes how he believes hackers have infected Androids with OmniRAT after sending an SMS. Chrysaidos says that OmniRAT can also be used for legitimate purposes, with the permission and consent of the owners of Android, Mac and Windows computers it tries to control. But in the hands of a cyber criminal it becomes a “Remote Access Trojan” – giving the malicious hackers an opportunity to sneakily spy on and steal from unsuspecting users duped into installing the code.



The OmniRAT spreads through phishing which takes the victim to a website laden with the installation file of OmniRAT. A German Android user explained on the Techboard forum on how he was lured into a website with OmniRAT. He said that had received an SMS telling him that an MMS had not been delivered directly to him due to the StageFright vulnerability. In order to access the MMS, he was told to follow a bit.ly link within three days, and enter a PIN code.

However, as Crysaidos explains, visiting the URL would initiate the attempt to install OmniRAT onto the target’s Android device:

Once you enter your number and code, an APK, mms-einst8923, is downloaded onto the Android device. The mms-einst8923.apk, once installed, loads a message onto the phone saying that the MMS settings have been successfully modified and loads an icon, labeled “MMS Retrieve” onto the phone.

Once the icon is opened by the victim, mms-einst8923.apk extracts OmniRat, which is encoded within the mms-einst8923.apk. In the example described on Techboard-online, a customized version of OmniRat is extracted.

The APK than demands the Android user to accept a long list of permissions which should trigger suspicions among tech savvy users.



Once installed, the App will send its own SMS message to the victims friends and colleagues listed in the contact list and further spread itself. The OmniRAT cannot be uninstalled once it is installed on the Android smartphones. Chrysaidos says that even if the victim uninstalls the MMS Retrieve icon, the customised version of OmniRAT remains installed on his/her Android smartphone, and will be sending data to a command and control (C&C) server seemingly based in Russia.

Chrysaidos says that Android users should undertake following steps to protect themselves from OmniRAT:

1. Make sure you have an antivirus solution installed on your smartphone to detect malware, like OmniRat. Avast detects OmniRat as Android:OmniRat-A [Trj].

2. Do not open any links from untrusted sources. If an unknown number or email address sends you a link, do not open the link.

3. Do not download apps from unknown sources to your mobile device. Only download apps from trusted sources such as the Google Play Store or the Apple App Store.




Like us on Facebook and subscribe with your email to receive all our latest updates via your inbox!

Read More >>

Snapchat Now Owns The Rights For All The Images You Take With Its App

Snapchat just reserved rights to use and distribute all photos taken with the app

Snapchat has been steadily gained popularity among smartphone users for is destroyable messages. While it has been providing secure image and video messaging between friends and dear one, it has not been without its share of controversy.

A unique feature of Snapchat is its ability to send messages with a short duration and then making it destroy itself after the user views it. This ability makes most users feel more relaxed with the content they share, due to the notion that the image will not be misused by anybody.

Well, that is going to change now as Snapchat has now introduced a reworked privacy policy and terms of service, giving firm rights to photos sent through the application.

As a user of the service, you give Snapchat the right to:

[…] host, store, use, display, reproduce, modify, adapt, edit, publish, create derivative works from, publicly perform, broadcast, distribute, syndicate, promote, exhibit, and publicly display that content in any form and in any and all media or distribution methods (now known or later developed).

Taking the new privacy by its face value means that Snapchat now owns all your images you take through its App. With this new policy, Snapchat is now able to use content sent through the app to promote its service, and distribute it among the public. While it is unclear how future plans have shaped this policy, this still shows a change in stance, in regards to user privacy.

FTC had earlier found fault with Snapchat service and has accused it of deceiving customers, by stating that images sent through the app would “disappear forever”. The FTC found that images could easily be extracted from the service and saved, regardless of their expiry stamp.
With the new privacy policy, FTC’s accusations rings true.



Like us on Facebook and subscribe with your email to receive all our latest updates via your inbox!

Read More >>

Porn Overtakes Ransomware As The Number One Threat For Smartphone Users In 2015

Porn has overtaken Ransomware as the most common form of threat to the smartphone owners. According to a report by Blue Coat System, in past 12 months, porn sites serving cyber threats to smartphone users surged in popularity to take top spot from ransomware.

The cybersecurity firm’s 2015 State of Mobile Malware report claimed that when it comes to ransomware, “much of the damage is often self-inflicted.”

It continues:

“Users seek out and install pirated, or otherwise shady, mobile apps, which are generally only available from unsavory websites or unsanctioned app stores. By the time they realize they’ve been hit with ransomware, the damage is already done.”
Those that get infected via porn sites are even less likely to come clean, preferring instead to keep their browsing habits a secret and pay the ransom, Blue Coat argued.

In fact, the firm noted that porn sites now account for 36% of infections, more than double the 16.5% of a year ago. The former number one infection vector of malicious web ads dropped from 20% to a mere 5% this year.

Felix Leder, director of advanced malware defense at Blue Coat, argued that most users who came across a malicious app last year “more than likely started their journey on a porn site.”

He added that one possible reason for cybercriminals turning away from malvertising is that users are more likely to report suspicious activity on regular sites, where malicious web ads typically thrive, than, say pornographic sites.

“While it’s hard to directly attribute it, I would also imagine that the increasing rise of ad blocker tech—and Apple’s introduction of content/ad blocking in iOS 9—has somewhat limited the effectiveness of ads as a way to spread malware,” he told Infosecurity.

Blue Coat warned users that with the growing trend of BYOD in the workplace, personal mobile usage has become an enterprise security issue.

IT managers must therefore invest in tech products that give them greater visibility into mobile usage in the workplace, and to enable guest Wi-Fi “with intelligent policies around data access.”

Users should also receive security awareness and training to reduce the chances of their downloading apps from unofficial sources; jailbreaking or rooting their devices; surfing for porn; connecting to public Wi-Fi, and more.



Like us on Facebook and subscribe with your email to receive all our latest updates via your inbox!

Read More >>

Hackers To Sale Over 13 Million Plaintext Passwords Stolen From 000webhost

000webhost, a popular free web hosting service, has suffered a data breach that resulted in the compromise of the name, email address and plaintext password of some 13 million of its customers.

The compromise was publicly disclosed on Wednesday by Troy Hunt, a Microsoft MVP for Developer Security and the creator and administrator of the Have I been pwned? service, where users can check whether their personal data has been leaked somewhere on the web.

He initially got the information about the breach from an anonymous tipster, who pointed him towards the database containing the compromised info.

He immediately started to analyze it, trying to discover whether the information in the database is legitimate. After having had many problems in trying to get in touch with someone at 000webhost who could help him, he made a public plea on Twitter, asking 000webhost users for help.

A few got in touch and confirmed that their email address and password are among the ones in the database.

After news about the possible breach started circulating, another tipster got in touch saying that "The database is selling for upwards of $2,000 right now, I can't understand which moron would be considering giving you a copy for free when people can make some serious money from this database."

The truthfulness of this message has later been confirmed by the original tipster, who told Hunt that he would prefer if no one notified 000webhost regarding this because friends of his are making money from the stolen information.

"So consider the ramifications of this: there are potentially 13M people having their details traded for commercial purposes. The only reason anyone pays for this sort of information is because they expect an ROI; they will gain something themselves from having paid a couple of grand for the credentials. That may mean exploiting the victims’ 000webhost account but more than likely it also means exploiting their other accounts where they’ve reused credentials," Hunt explained.

000webhost finally confirmed the breach on Wednesday afternoon.

"A hacker used an exploit in old PHP version to upload some files, gaining access to our systems. Although the whole database has been compromised, we are mostly concerned about the leaked client information," they said on their Facebook page, but said nothing about plaintext passwords.

What they did say is that they "changed all the passwords and increased their encryption to avoid such mishaps in the future", and advised users to change their passwords for the hosting account, email account, and MySQL user database.

"We apologize for this hassle but it has to be done to ensure your data is safe. We are going to upgrade our systems step by step and will be aiming to be super-careful in future," they concluded.

But, according to Hunt's analysis of the company's site, their security practices are very sloppy to begin with, so this promises don't mean much.

As of Tuesday morning, all 000webhost users who tried to login to the service were urged to change their passwords, which have been reset by the company's system for security reasons.

Still, no additional explanation of this or a notification about the breach has been sent directly to the users. And the fact that the breach happened approximately five months ago has not been mentioned by the hosting company.

This long period between the breach and its discovery and/or its public acknowledgement has certainly allowed criminals to compromise various accounts of those careless users who used the same password on a number of accounts.

Hunt also pointed out that some other web hosting providers who have probably partnered with 000webhost have possibly been breached, and their stolen information included in the database for sale.


source
Like us on Facebook and subscribe with your email to receive all our latest updates via your inbox!

Read More >>

WhatsApp Collects Users Phone Numbers And Call Duration Without Their Knowledge

WhatsApp’s new calling feature has been collecting users phone numbers and call duration without their knowledge.

If you thought your voice calls made on the WhatsApp’s voice calling feature were private, you are mistaken. Apparently, the Facebook owned company is collecting your phone numbers and your phone call duration without your knowledge. This was revealed by researchers from University of New Haven’s Cyber Forensics Research & Education Group.

The researchers did a forensic examination of the popular cross platform messaging service, WhatsApp and found that data that can be collected from the app’s network from its new calling feature: such as phone numbers and phone call duration, and highlights areas for future research and study.

The group has detailed its study in a paper published in the scholarly journal, Digital Investigation. The article was co-authored by F. Karpisek of Brno University of Technology in the Czech Republic, Ibrahim (Abe) Baggili and Frank Breitinger, co-directors of the Cyber Forensics Research & Education Group at the University of New Haven.

“Our research demonstrates the type of data that can be gathered through the forensic study of WhatsApp and provides a path for others to conduct additional studies into the network forensics of messaging apps,” said Baggili.

According to the researchers, decrypting the network traffic isn’t simple, as both access to data on the device as well as the full network traffic is needed.

“We decrypted the WhatsApp client connection to the WhatsApp servers and visualized messages exchanged through such a connection using a command-line tool we created,” the authors wrote. “This tool may be useful for deeper analysis of the WhatsApp protocol.”

In the paper, the researchers have provided an outline of the WhatsApp messaging protocol from a networking perspective, making it possible to explore and study WhatsApp network communications. He said he believes they are the first to discuss “WhatsApp signaling messages used when establishing voice calls.”

Specifically, the researchers found that WhatsApp uses the FunXMPP protocol for message exchange, which is a binary-efficient encoded Extensible Messaging and Presence Protocol (XMPP) (WHAnonymous, 2015c).
Through the analysis of signaling messages exchanged during a WhatsApp call using an Android device, the researchers were able to closely examine the authentication process of WhatsApp clients; discover what codec WhatsApp is using for voice media streams (Opus at 8 or 16 kHz sampling rates); understand how relay servers are announced and the relay election mechanism; and understand how clients announce their endpoint addresses for media streams.

“Gaining insight into these signaling messages is essential for the understanding of the WhatsApp protocol, especially in the area of WhatsApp,” the authors wrote.
The researchers were able to acquire interesting details from network traffic, including WhatsApp phone numbers, WhatsApp phone call establishment metadata and date-time stamps, and WhatsApp phone call duration metadata and date-time stamps. They also were able to acquire WhatsApp’s phone call voice codec (Opus) and WhatsApp’s relay server IP addresses used during the calls.



source
Like us on Facebook and subscribe with your email to receive all our latest updates via your inbox!

Read More >>