WhatSapp Vulnerability
Content
Digital Investigation xxx (2015) 1e9
Contents lists available at ScienceDirect
Digital Investigation
journal homepage: www.elsevier.com/locate/diin
WhatsApp network forensics: Decrypting and understanding
the WhatsApp call signaling messages
F. Karpisek a, I. Baggili b, *, F. Breitinger b
a
Faculty of Information Technology, Brno University of Technology, Czech Republic
Cyber Forensics Research & Education Group, Tagliatela College of Engineering, ECECS, University of New Haven, 300 Boston Post Rd.,
West Haven, CT, 06516, USA
b
a r t i c l e i n f o
a b s t r a c t
Article history:
Received 10 July 2015
Received in revised form 17 September 2015
Accepted 19 September 2015
Available online xxxx
WhatsApp is a widely adopted mobile messaging application with over 800 million users.
Recently, a calling feature was added to the application and no comprehensive digital
forensic analysis has been performed with regards to this feature at the time of writing this
paper. In this work, we describe how we were able to decrypt the network traffic and
obtain forensic artifacts that relate to this new calling feature which included the: a)
WhatsApp phone numbers, b) WhatsApp server IPs, c) WhatsApp audio codec (Opus), d)
WhatsApp call duration, and e) WhatsApp's call termination. We explain the methods and
tools used to decrypt the traffic as well as thoroughly elaborate on our findings with
respect to the WhatsApp signaling messages. Furthermore, we also provide the community with a tool that helps in the visualization of the WhatsApp protocol messages.
© 2015 Elsevier Ltd. All rights reserved.
Keywords:
WhatsApp
Reverse engineering
Proprietary protocol
Signaling protocols
Network forensics
Decryption
Mobile forensics
Digital forensics
Cyber security
Audio encoding
Introduction
WhatsApp is one of the most widely used personalmessaging mobile applications for free texting and content sharing (namely audio, video, images, location and
contacts), boasting over 800 million users worldwide and
was bought by facebook in 2014 for $19 Billion.1 The calling
feature was added recently in version 2.11.552, which was
released 2015-03-05 (Arce, 2015).
From its wide adoption, it is obvious how WhastApp
communication exchanges may be used during an
* Corresponding author.
E-mail addresses: xkarpi03@stud.fit.vutbr.cz (F. Karpisek), IBaggili@
newhaven.edu (I. Baggili), [email protected] (F. Breitinger).
URL: http://www.unhcfreg.com/, http://www.FBreitinger.de/
1
http://money.cnn.com/2014/02/19/technology/social/facebookwhatsapp/, last accessed 2015-07-03.
investigation, making the artifacts it produces of compelling forensic relevance. Therefore, we see a strong necessity
for both researchers and practitioners to gain a comprehensive understanding of the networking protocol used in
WhatsApp, as well as the type of forensically relevant data
it contains. Most importantly, due to the newly introduced
calling feature, it becomes essential to understand the
signaling messages used in the establishment of calls between the WhatsApp clients and servers. The methods and
tools used in this research could be relevant to investigations where proving that a call was made at a certain
date and time is necessary.
Our contribution outlines the WhatsApp messaging
protocol from a networking perspective and provides a
solution to explore and study WhatsApp network communications. In terms of novelty, to our knowledge, this is
the first paper that discusses the WhatsApp signaling
messages used when establishing voice calls. The work has
http://dx.doi.org/10.1016/j.diin.2015.09.002
1742-2876/© 2015 Elsevier Ltd. All rights reserved.
Please cite this article in press as: Karpisek F, et al., WhatsApp network forensics: Decrypting and understanding the WhatsApp
call signaling messages, Digital Investigation (2015), http://dx.doi.org/10.1016/j.diin.2015.09.002
2
F. Karpisek et al. / Digital Investigation xxx (2015) 1e9
impact on practitioners in the field that have obtained
network traffic for a potential suspect, as well as providing
scientists literature for better understanding the network
protocol itself.
The rest of the paper is organized as follows. In Section
Related work we review existing work, while Section
WhatsApp protocol describes the WhatsApp protocol.
Then, in Section Tool for visualizing WhatsApp protocol
messages we describe the tool we created for visualizing
exchanged WhatsApp messages. In Section Decryption, we
describe the process of obtaining decrypted connections
between the WhatsApp client and the WhatsApp server.
Then in Section Findings we examine the message contents
and discuss the meaning of the signaling messages during a
WhatsApp call. Finally, in Section Conclusions, we offer
concluding remarks and outline some future research.
Related work
There has been research conducted on the forensics of
WhatsApp but the majority of that work focused on the
data that WhatsApp stores on the mobile device when
compared to our work which focuses on the network forensics of WhatsApp.
Network protocol forensics
At the time of writing this paper, the work on network
protocol forensics of WhatsApp was sparse. The only work
that provided any detail on WhatsApp's networking protocol was the Hancke (2015) report. Hancke (2015)'s work
focused more on Realtime Transport Protocol (RTP) media
streams (Schulzrinne et al., 2003). The report fails to uncover the call signaling messages used by WhatsApp, which
is elaborated on by our work.
Mobile device forensics
Anglano (2014) performed an in-depth analysis of
WhatsApp on Android devices. The work provided a
comprehensive description of the artifacts generated by
WhatsApp and discussed the decoding, interpretation and
relationship between the artifacts. Anglano (2014) was able
to provide an analyst with the means of reconstructing the
list of contacts and chronology of the messages that have
been exchanged by users.
The works by Thakur (2013) and Mahajan et al. (2013) are
similar to previous studies since they both focused on the
forensic analysis of WhatsApp on Android. These studies
uncovered the forensic acquisition of the artifacts left by
WhatsApp on the device. Thakur (2013) focused on the
forensic analysis of WhatsApp artifacts on an Android phone's
storage and volatile memory. The results showed that one is
able to obtain many artifacts such as phone numbers, messages, media files, locations, profile pictures, logs and more.
Mahajan et al. (2013) analyzed WhatsApp and Viber artifacts
using the Cellebrite Forensic Extraction Device (UFED) toolkit.
They were able to recover contact lists, exchanged messages
and media including their timestamps and call details.
Walnycky et al. (2015) examined 20 different popular
mobile social-messaging applications for Android including
WhatsApp. In their work, they focused on unencrypted
traffic that could be easily reconstructed. WhatsApp was
found to be favorable at encrypting its network traffic when
compared to other mobile social-messaging applications.
Therefore, based on the primarily findings by Walnycky
et al. (2015), our study aimed at further investigating and
dissecting the WhatsApp protocol, and in specific, focusing
on the signaling messages used when establishing WhatsApp calls given this new feature. However, in order to dive
deeper into the signaling messages, one must understand
some known attributes of the WhatsApp protocol which
we discuss in Section WhatsApp protocol below.
WhatsApp protocol
WhatsApp uses the FunXMPP protocol for message exchange which is a binary-efficient encoded Extensible
Messaging and Presence Protocol (XMPP) (WHAnonymous,
2015c). The WhatsApp protocol is also briefly described by
LowLevel-Studios (2012) from an implementation perspective. To fully describe the FunXMPP protocol is beyond this
paper's scope. For more information on the protocol the
readers may want visit a website outlining the protocol.2
Authentication procedure
There are two types of authentication procedures the
WhatsApp client can use when connecting to the servers. If
it is the first time the client is connecting to the server, a full
handshake is performed as illustrated in Fig. 1. Subsequently, for any consecutive connections, only a half
handshake is executed using data provided from the initial
full handshake.
We note that a half handshake therefore results in using
the same session keys multiple times, which can be
deemed as a plausible protocol security weakness.
Full handshake
The authentication procedure as described by the developers of WhatsAPI consists of three messages
(WHAnonymous, 2015a). This is synonymous with the well
known three-way handshake and is described in detail in
the following paragraphs. These messages can be observed
in Fig. 1 which was created using our developed tool (for
more details see Section Tool for visualizing WhatsApp
protocol messages).
As shown in Fig. 1, first, the client sends an <auth>
message to the server. This message is not encrypted and
contains the client number and authentication method the
client wants to use.
Then, the server replies with a <challenge> message
containing a 20 byte long nonce for the session key generation. Session keys are then generated using the PasswordBased Key Derivation Function 2 (PBKDF2) algorithm using
the password as a passphrase and the nonce as a salt. Both
the server and the client know the password and nonce so
the generated keys are the same on both ends. Four keys are
2
https://github.com/WHAnonymous/Chat-API/wiki/FunXMPPProtocol, last accessed 2015-07-03.
Please cite this article in press as: Karpisek F, et al., WhatsApp network forensics: Decrypting and understanding the WhatsApp
call signaling messages, Digital Investigation (2015), http://dx.doi.org/10.1016/j.diin.2015.09.002
F. Karpisek et al. / Digital Investigation xxx (2015) 1e9
3
Fig. 1. Full handshake between WhatsApp client and server. Note: Numbers on the left side represent packet numbers (see Appendix A for the source pcap file).
Also, there can be multiple messages in one packet.
generated in total: two keys for confidentiality (one for each
direction e from the server and to server) and two keys for
the integrity check (again one for each direction).
The client then creates a <response> message that
consists of a concatenated client phone number in ASCII,
nonce sent by the server in binary, current Unix timestamp
in ASCII and other device description data. This message is
encrypted using the generated session keys and it is prepended by the hash of the message for integrity checking
purposes. Decrypted contents of the response message are
illustrated in Fig. 2, where we can see the aforementioned
fields e their hexadecimal value and also the ASCII representation as displayed by Wireshark.
If registration is successful, the server replies with a
<success> message that is encrypted. Otherwise, the server
replies with a <failure> message that is not encrypted.
Half handshake
A half handshake consists only of an <auth> message
that already contains the data of a <response> message
described above, and the server's reply, a <success> message. The client uses the nonce from the earlier session
which means that this nonce is not known by outsiders,
therefore, it is not possible to decrypt such a session, as
session encryption keys cannot be determined.
Tool for visualizing WhatsApp protocol messages
Description
Our tool is a command-line program written in Python
(version 2.7). It is named convertPDML.py as it converts the
PDML file exported from Wireshark to an HTML report. It is
available in the form of source code, see Appendix A for
more details. It requires one input parameter; a path to an
XML file containing the details of dissected packets. See the
step 6 in Section Decryption procedure for details on how
to create the XML file.
The output of the tool is a report file containing all the
messages exchanged between the WhatsApp client and the
WhatsApp servers in HTML format as shown in Fig. 1.
Hence, any standard browser can be used to view the results. Messages are ordered chronologically as they appear
in the input XML file.
Please cite this article in press as: Karpisek F, et al., WhatsApp network forensics: Decrypting and understanding the WhatsApp
call signaling messages, Digital Investigation (2015), http://dx.doi.org/10.1016/j.diin.2015.09.002
4
F. Karpisek et al. / Digital Investigation xxx (2015) 1e9
Fig. 2. Content of <response> message with marked regions.
Usage
As mentioned above, the tool requires am XML file as an
input parameter. Example: convertPDML.py INPUT.xml.
Network traffic collection
This section explains how we collected the WhatsApp
network traffic. More details are presented in Sections
Experimental setup and High level methodology.
Experimental setup
We used the setup exemplified in Fig. 3 for capturing
network traffic between the WhatsApp messenger running
on an Android phone and the WhatsApp servers. The
hardware and software used in the experimental setup are
listed below:
Equipment used in experimental setup:
Phone: Lenovo P780, Android 4.2.1, running
e Whatsapp v2.12.84 which was downloaded from
the Google play store.
e Password Extractor v1.03.
Laptop: Lenovo ThinkPad T420s with Windows 7 64-bit
with the following installed software:
e Wireshark v1.12.5, 32-bit, with the WhatsApp
dissector.4
e Pidgin v2.12.11,5 32-bit, with the WhatsApp plugin.6
application to gain access to the WhatsApp password. We
note that the phone had to be rooted to use this application.
We would also like to mention that there could have been
multiple ways to gain access to the password on the device
such as using commercially available tools to acquire a
forensic image of the phone, and in some cases gaining
access to the password can be achieved without rooting the
phone if the acquisition method allows the investigator to
acquire the image without rooting the device.
We then utilized Pidgin messenger with the WhatsApp
plugin and obtained the WhatsApp password for connecting to the WhatsApp servers in order to desynchronize the
WhatsApp client installed on the Android phone. This was
performed in order for us to capture the full handshake (see
Section Full handshake for more details).
The next step included setting up a wifi access point (see
Fig. 3) on the laptop and sharing the Internet connection
from the Ethernet port to the wifi adapter. The laptop now
acted as a wifi router. We then started capturing all the
traffic on the access point's network. In the next step, we
connected the phone to the created wifi network and made
a WhatsApp call to a user with phone number 1-203-xxxxxxx. Finally, we finished capturing the traffic and saved
the created pcap file.
Following the aforementioned methodology allowed us
to collect network traffic enabling us to perform exploratory analysis. In the following Section Decryption, we
outline the resultant steps that we were able to reproduce
for decrypting the WhatsApp messaging traffic.
Decryption
High level methodology
First, we disconnected the Android phone from any
Internet connection and used the Password Extractor
3
https://www.mgp25.com/downloads/pw.apk, last accessed 2015-07-
06.
4
https://davidgf.net/page/37/whatsapp-dissector-for-wireshark,
accessed 2015-07-06.
5
https://pidgin.im/, last accessed 2015-07-06.
6
https://davidgf.net/whatsapp/, last accessed 2015-07-06.
last
According
to
LowLevel-Studios
(2012)
and
WHAnonymous (2015a), encryption and decryption in
WhatsApp is performed with a symmetric RC4 stream cipher using keys generated during authentication which is
described in the Section Authentication procedure.
Therefore, in order to decrypt the communication between the WhatsApp servers and the WhatsApp client,
session keys for each direction (as WhatsApp uses one key
for communication from device to the server and a
different one for communication from the server to the
Please cite this article in press as: Karpisek F, et al., WhatsApp network forensics: Decrypting and understanding the WhatsApp
call signaling messages, Digital Investigation (2015), http://dx.doi.org/10.1016/j.diin.2015.09.002
F. Karpisek et al. / Digital Investigation xxx (2015) 1e9
5
Fig. 3. Experimental setup.
device) are required. The process of obtaining these keys is
provided in Section Full handshake.
the exchange of WhatsApp protocol's messages between
the WhatsApp client and the servers.
Prerequisites
1. As the Android phone we were using, was rooted,
obtaining the password was as easy as installing and
running an application mentioned in the Section Tools
used. In our case, the username (phone number) was
420xxxxxxxxx with the following extracted password
627XlMqch8i5Ncy2tRSbZLXs2m0¼.
2. After obtaining credentials for the WhatsApp account
(phone number and password), we disconnected the
mobile device running WhatsApp from the wifi network
and used the IM client Pidgin with the WhatsApp plugin
and used the obtained credentials to log into our
WhatsApp account. This broke the synchronization between the WhatsApp client on the mobile device and the
WhatsApp server forcing the client to authenticate using
a full handshake.
3. We then connected the mobile device running the
WhatsApp client back to the wifi access point capturing
all the communication from and to the mobile device as
explained in Section Experimental setup. After the
WhatsApp client logged into the WhatsApp account, we
placed a WhatsApp call to another device. All recorded
communication was saved to a pcap file. Access to the
pcap file is presented in the Appendix A.
4. After we captured all the communication between the
WhatsApp client and the WhatsApp server, we provided
the WhatsApp dissector in Wireshark with the credentials we obtained in the prior steps. To do that we used
Wireshark's menu Edit e> Preferences and in the Protocols section we set up the WhatsApp dissector with
the same options exemplified in Fig. 4.
After setting up the WhatsApp dissector correctly, we were
able to observe the content of encrypted messages and the
content of the <response> message should start with the
number used in <auth> message as shown in Fig. 2.
5. When the communication was decrypted we exported it
to XML format using Wireshark's function File e> Export
Packet Dissections e> as XML e “PDML” (packet details)
file.... We provide access to this XML file in the Appendix
A. Part of this XML file e namely <auth> is illustrated in
Listing 1 where we can see the same values as in <auth>
Our work showed that there are two mandatory requirements for the successful decryption of WhatsApp
messaging connections:
The password associated with the WhatsApp account.
The record of the full handshake between the WhatsApp
client and the server.
Tools used
We outline the list of software tools that were used in
the decryption process:
To obtain the password, there are multiple options
based on the mobile device being used (WHAnonymous,
2015b). As we were using an already rooted Android
phone, the easiest way was to extract the password
using the Password Extractor application.
To force WhatsApp to establish a full handshake the
next time the mobile device connected to the server, it
was necessary to break the synchronization between
the WhatsApp client and the server. The simplest way
for doing that was to connect using a different client. For
that purpose, we used the IM client Pidgin alongside the
WhatsApp plugin.
To decrypt the WhatsApp connection between the client
and server, we used Wireshark and a WhatsApp-specific
dissector.
To visualize the WhatsApp protocol message exchange
we created a command-line tool described in Section
Tool for visualizing WhatsApp protocol messages.
Decryption procedure
In this section, we elaborate using a step-by-step procedure describing how to successfully decrypt and visualize
Please cite this article in press as: Karpisek F, et al., WhatsApp network forensics: Decrypting and understanding the WhatsApp
call signaling messages, Digital Investigation (2015), http://dx.doi.org/10.1016/j.diin.2015.09.002
6
F. Karpisek et al. / Digital Investigation xxx (2015) 1e9
Fig. 4. WhatsApp Wireshark dissector settings.
message from Fig. 1 e attribute user with value
420xxxxxxxxx (lines 33e38) and attribute mechanism
with value WAUTH-2 (lines 39e44).
6. The final step involved using our tool to generate a
report of the WhatsApp message exchange between the
WhatsApp client and WhatsApp servers. For that we
used the XML file generated in the previous step. For
more details refer to the Section Tool for visualizing
WhatsApp protocol messages.
Findings
In the following subsections, we describe our findings
on the signaling messages used for call establishment in
WhatsApp. For a visual representation of our findings
readers may want to refer to Fig. 5.
Protocol analysis of call signaling messages
In this section we elaborate on messages that we hypothesize are part of the establishment of a WhatsApp call
as we observed it in the decrypted captured communication traffic. We used the captured pcap file and the HTML
report generated from the same pcap file (refer to the
Section Decryption procedure for more details). Both of
these files can be downloaded from Appendix A. In the rest
of this section, we refer to the packet numbers displayed on
the leftmost side in the flow diagram of signaling message
exchange in Fig. 5.
First (in packets [8]e[32]), the WhatsApp client connects and authenticates with the first WhatsApp server
174.37.231.87 but there is no activity regarding a call.
Starting with packet [33], the WhatsApp client connects
and authenticates to a second WhatsApp server
174.36.210.45 and starts placing a call.
Right after connecting to the second server, in packet
[41], the client asks for the presence of the called party
Fig. 5. Signaling messages of WhatsApp call (numbers refer to packet
numbers).
Please cite this article in press as: Karpisek F, et al., WhatsApp network forensics: Decrypting and understanding the WhatsApp
call signaling messages, Digital Investigation (2015), http://dx.doi.org/10.1016/j.diin.2015.09.002
F. Karpisek et al. / Digital Investigation xxx (2015) 1e9
(phone number 1-203-xxx-xxxx) and starts the call
establishment process by sending <offer> message to
the called party. This happens in packet [42]. There we
can observe the property call-id¼“1431719979-2” for the
first time. This property remains constant throughout
the rest of the signaling messages during the whole
signaling process and it identifies the call as it is unique
for each call and therefore changes every time a call is
initiated.
In this first message we can also observe that the caller is
offering to use the Opus codec (Valin et al., 2012) (in property <audio>) for voice data in two sampling rates, 8 kHz
and 16 kHz. We also observe the properties <p2p> (value of
16 bytes ¼ 128 bits) and <srtp> (192 bytes ¼ 1536 bits)
values which we were not able to decode. We postulate that
they might be some kind of initialization vectors for
encryption of media streams and/or description of these
streams. The last property is <te> contains a 6 byte value
that we decoded as the endpoint (IP address and port)
where the client announces the endpoint address for the
media stream. Its value is 192.168.137.208:46416.
The server replies with <ack relay> in packet [43] which
contains property <token> (value of 204 bytes ¼ 1632 bits)
which we were also unable to decode, multiple properties
<te> that announce endpoint addresses of relay servers (8
servers in total), and properties <encode>, <agc> (gain
control) and <ns> (noise suppression) that we hypothesize
further specify media encoding.
Packets [44] and [45] carry messages <receipt> and of
the receipt. To the best of our knowledge, these messages
do not contain any data of interest.
Packet [46] going from the server to the client carries the
message <preaccept> and has the property <audio> that
asserts that the used codec for media streams will be the
Opus codec at the sampling rate of 16 kHz. It also contains
the property <srtp> that has the same length as the same
<srtp> property in packet [42] (192 bytes ¼ 1536 bits) but
carries different value.
Packet [47] carries the message <transport> which contains the client's endpoint address but from an external point
of view e a public endpoint address. This address is found out
by the client using Traversal Using Relays around NAT (TURN)
mechanism (Mahy et al., 2010) e client asks the TURN server
what is its (client's) IP address from the outside point of view.
Its value is 64.251.61.74:62334 which differs from the value
in packet [42] e 192.168.137.208:46416. Packet [48] carries
the <ack> message to the previous message.
We can observe a relay server election in packets [49]e
[65]. The client finds out latency between itself and the
relay servers obtained from message <relay> from packet
[43] and one of the servers is elected.
The last message of the call establishment process is
message <accept> in packet [70]. It contains the property
<audio> that confirms that the used codec is Opus, sampling rate 16 kHz, properties <p2p> and <srtp> (with the
same value as in packet [47]) and two endpoint addresses:
private
e
192.168.1.22:55607
and
public
e
64.251.61.74:55607. These endpoint addresses are used
when trying to establish a direct peer-to-peer (P2P)
connection. Packet [71] contains <receipt> message confirming the previous message.
7
After that, both-way media stream is established from
192.168.137.208:46416 to 31.13.74.48:3478 using RTP. These
addresses were announced in a message in packet [42] and
during the relay server election.
After about 30 s of the ongoing call, the client connects
to another WhatsApp server (108.168.180.110) and
signaling messages start flowing through this server. The
client then announces new endpoint addresses in packets
[2688] and [2711] and after a new relay election process, a
new media stream is created replacing the previous one
using a new endpoint address.
Finally, the client connects to another WhatsApp server
(174.37.231.88) and sends two identical messages <terminate> in packets [7921] and [7925] and the call is
terminated.
Media streams
Hancke (2015) mentioned in his report that WhatsApp
uses a codec at 16 kHz sampling rate with bandwidth of
about 20 kbit/s. Unlike us, Philipp Hancke did not have
access to the decrypted signaling messages and thus we can
now declare that WhatsApp is using the Opus codec for
voice media streams at either 8 kHz or 16 kHz sampling
rate which is decided at call setup.
We attempted to decode the media using the opensource implementation of the Opus codec7 but the decoded result was not voice audio. From that and from the
fact that we can observe <srtp> properties (SRTP stands
for Secure Realtime Transport Protocol (Baugher et al.,
2004)) we infer that these media streams are being
encrypted.
Analysis summary
Through the analysis of signaling messages exchanged
during a WhatsApp call we were able to:
Closely examine the authentication process of WhatsApp clients.
Discover what codec WhatsApp is using for voice media
streams e Opus at 8 or 16 kHz sampling rates.
Understand how relay servers are announced and the
relay election mechanism.
Understand how clients announce their endpoint addresses for media streams.
Gaining insight into these signaling messages is essential for the understanding of the WhatsApp protocol
especially in the area of WhatsApp call analysis from a
forensic networking perspective.
Forensically relevant artifacts
As shown in Table 1, forensically relevant artifacts may
be extracted from the network traffic using the outlined
7
http://www.opus-codec.org/, last accessed 2015-07-06.
Please cite this article in press as: Karpisek F, et al., WhatsApp network forensics: Decrypting and understanding the WhatsApp
call signaling messages, Digital Investigation (2015), http://dx.doi.org/10.1016/j.diin.2015.09.002
8
F. Karpisek et al. / Digital Investigation xxx (2015) 1e9
Table 1
Forensically relevant data, their location and sample data.
methodology. Most notably (see Fig. 1), we were able to
acquire the following artifacts from the network traffic:
WhatsApp phone numbers.
WhatsApp phone call establishment metadata and
datetime stamps.
WhatsApp phone call termination metadata and datetime stamps.
WhatsApp phone call duration metadata and datetime
stamps.
WhatsApp's phone call voice codec (Opus).
WhatsApp's relay server IP addresses used during the
calls.
Conclusions
In this work, we decrypted the WhatsApp client
connection to the WhatsApp servers and visualized messages exchanged through such a connection using a
command-line tool we created. This tool may be useful for
deeper analysis of the WhatsApp protocol.
We also uncovered the hypothesized signaling messages of the WhatsApp call which revealed what codec is
being actually used for media transfer (Opus), as well as
forensically relevant metadata about the call establishment, termination, duration and phone numbers associated with the call.
Future work
In this work we were unable to decode media RTP
streams as they seem to be encrypted. However, we hypothesize that encryption keys are most likely being
transferred inside the signaling messages during the set up
of a WhatsApp call and therefore we postulate that it
should be possible, in theory, to decrypt these media
streams as well. The main challenge for this task is to find
out the encryption keys and encryption algorithm used.
We would also like to note that a limitation of our
work is that it was tested on an Android device. Although
we hypothesize that the protocol used in the communication will be constant across platforms, recreating the
experiments with different devices and operating systems running WhatsApp is needed to validate that claim.
Also, we would like to note that as more features are
added to WhatsApp, more experiments need to be conducted to ensure that the design of the protocol does not
change.
We would also like to encourage other researchers to
apply the techniques explained in our work to analyze the
network traffic of other popular messaging applications so
that the forensic community can gain a better understanding of the forensically relevant artifacts that may be
extracted from the network traffic, and not only the data
stored on the devices.
Please cite this article in press as: Karpisek F, et al., WhatsApp network forensics: Decrypting and understanding the WhatsApp
call signaling messages, Digital Investigation (2015), http://dx.doi.org/10.1016/j.diin.2015.09.002
F. Karpisek et al. / Digital Investigation xxx (2015) 1e9
Appendix A. Reference files
These are files that were used throughout this paper.
These files can be provided to researchers by visiting our
website http://www.unhcfreg.com under Tools & Data.
whatsapp_register_and_call.pcap e pcap file containing
user with phone number 420xxxxxxxxx connecting to
multiple WhatsApp servers and placing a call to the user
with phone number 1-203-xxx-xxxx.
whatsapp_register_and_call.xml e content of previous
pcap file exported from Wireshark in XML format.
whatsapp_register_and_call.html e HTML file that was
generated from previous XML file using our tool.
convertPDML.py e command-line tool for converting
XML files exported from Wireshark to a visual HTML
report containing flow of WhatsApp messages exchanged
between WhatsApp Messenger and the WhatsApp
servers.
References
Anglano C. Forensic analysis of whatsapp messenger on android smartphones. Digit Investig 2014;11:201e13. URL, http://www.sciencedirect.
com/science/article/pii/S1742287614000437 [last accessed 06.07.15].
Arce N. Whatsapp calling for android and IOS: How to get it and what to
know. 2015. URL, http://www.techtimes.com/articles/38291/20150309/
whatsapp-calling-for-android-and-ios-how-to-get-it-and-what-toknow.htm [last accessed 27.05.15].
9
Baugher M, McGrew D, Naslund M, Carrara E, Norrman K. The secure realtime transport protocol (SRTP). 2004. URL, https://www.ietf.org/rfc/
rfc3711.txt [last accessed 06.07.15].
Hancke P. Whatsapp exposed: Investigative report. 2015. URL, https://
webrtchacks.com/wp-content/uploads/2015/04/WhatsappReport.pdf
[last accessed 03.06.15].
LowLevel-Studios. Whatsapp protocol 1.2: a brief explanation. 2012. URL,
http://lowlevel-studios.com/whatsapp-protocol-1-2-a-briefexplanation/ [last accessed 03.06.15].
Mahajan A, Dahiya M, Sanghvi H. Forensic analysis of instant messenger
applications on android devices. 2013. arXiv preprint arXiv:1304.4915,.
URL, http://arxiv.org/abs/1304.4915 [last accessed 06.07.15].
Mahy R, Matthews P, Rosenberg J. Traversal using relays around NAT
(TURN). 2010. URL, https://tools.ietf.org/html/rfc5766 [last accessed
06.07.15].
Schulzrinne H, Casner S, Frederick R, Jacobson V. RTP: a transport protocol
for real-time applications. 2003. URL, https://www.ietf.org/rfc/
rfc3550.txt [last accessed 06.07.15].
Thakur NS. Forensic analysis of WhatsApp on android smartphones
(Master's thesis). University of New Orleans; 2013. URL, http://
scholarworks.uno.edu/td/1706/ [last accessed 06.07.15].
Valin J, Vos K, Terriberry T. Definition of the opus audio codec. 2012. URL,
http://tools.ietf.org/html/rfc6716 [last accessed 06.07.15].
Walnycky D, Baggili I, Marrington A, Moore J, Breitinger F. Network and
device forensic analysis of android social-messaging applications.
Digit Investig 2015;14:S77e84.
WHAnonymous. Authentication overview (WAUTH 2). 2015. URL, https://
github.com/WHAnonymous/Chat-API/wiki/AuthenticationOverview-(WAUTH-2. https://github.com/WHAnonymous/Chat-API/
wiki/Authentication-Overview-(WAUTH-2) [last accessed 03.06.15].
WHAnonymous. Extracting password from device. 2015. URL, https://
github.com/WHAnonymous/Chat-API/wiki/Extracting-passwordfrom-device [last accessed 12.06.15].
WHAnonymous. Funxmpp-protocol. 2015. URL, https://github.com/
WHAnonymous/Chat-API/wiki/FunXMPP-Protocol [last accessed
03.06.15].
Please cite this article in press as: Karpisek F, et al., WhatsApp network forensics: Decrypting and understanding the WhatsApp
call signaling messages, Digital Investigation (2015), http://dx.doi.org/10.1016/j.diin.2015.09.002
Contents lists available at ScienceDirect
Digital Investigation
journal homepage: www.elsevier.com/locate/diin
WhatsApp network forensics: Decrypting and understanding
the WhatsApp call signaling messages
F. Karpisek a, I. Baggili b, *, F. Breitinger b
a
Faculty of Information Technology, Brno University of Technology, Czech Republic
Cyber Forensics Research & Education Group, Tagliatela College of Engineering, ECECS, University of New Haven, 300 Boston Post Rd.,
West Haven, CT, 06516, USA
b
a r t i c l e i n f o
a b s t r a c t
Article history:
Received 10 July 2015
Received in revised form 17 September 2015
Accepted 19 September 2015
Available online xxxx
WhatsApp is a widely adopted mobile messaging application with over 800 million users.
Recently, a calling feature was added to the application and no comprehensive digital
forensic analysis has been performed with regards to this feature at the time of writing this
paper. In this work, we describe how we were able to decrypt the network traffic and
obtain forensic artifacts that relate to this new calling feature which included the: a)
WhatsApp phone numbers, b) WhatsApp server IPs, c) WhatsApp audio codec (Opus), d)
WhatsApp call duration, and e) WhatsApp's call termination. We explain the methods and
tools used to decrypt the traffic as well as thoroughly elaborate on our findings with
respect to the WhatsApp signaling messages. Furthermore, we also provide the community with a tool that helps in the visualization of the WhatsApp protocol messages.
© 2015 Elsevier Ltd. All rights reserved.
Keywords:
Reverse engineering
Proprietary protocol
Signaling protocols
Network forensics
Decryption
Mobile forensics
Digital forensics
Cyber security
Audio encoding
Introduction
WhatsApp is one of the most widely used personalmessaging mobile applications for free texting and content sharing (namely audio, video, images, location and
contacts), boasting over 800 million users worldwide and
was bought by facebook in 2014 for $19 Billion.1 The calling
feature was added recently in version 2.11.552, which was
released 2015-03-05 (Arce, 2015).
From its wide adoption, it is obvious how WhastApp
communication exchanges may be used during an
* Corresponding author.
E-mail addresses: xkarpi03@stud.fit.vutbr.cz (F. Karpisek), IBaggili@
newhaven.edu (I. Baggili), [email protected] (F. Breitinger).
URL: http://www.unhcfreg.com/, http://www.FBreitinger.de/
1
http://money.cnn.com/2014/02/19/technology/social/facebookwhatsapp/, last accessed 2015-07-03.
investigation, making the artifacts it produces of compelling forensic relevance. Therefore, we see a strong necessity
for both researchers and practitioners to gain a comprehensive understanding of the networking protocol used in
WhatsApp, as well as the type of forensically relevant data
it contains. Most importantly, due to the newly introduced
calling feature, it becomes essential to understand the
signaling messages used in the establishment of calls between the WhatsApp clients and servers. The methods and
tools used in this research could be relevant to investigations where proving that a call was made at a certain
date and time is necessary.
Our contribution outlines the WhatsApp messaging
protocol from a networking perspective and provides a
solution to explore and study WhatsApp network communications. In terms of novelty, to our knowledge, this is
the first paper that discusses the WhatsApp signaling
messages used when establishing voice calls. The work has
http://dx.doi.org/10.1016/j.diin.2015.09.002
1742-2876/© 2015 Elsevier Ltd. All rights reserved.
Please cite this article in press as: Karpisek F, et al., WhatsApp network forensics: Decrypting and understanding the WhatsApp
call signaling messages, Digital Investigation (2015), http://dx.doi.org/10.1016/j.diin.2015.09.002
2
F. Karpisek et al. / Digital Investigation xxx (2015) 1e9
impact on practitioners in the field that have obtained
network traffic for a potential suspect, as well as providing
scientists literature for better understanding the network
protocol itself.
The rest of the paper is organized as follows. In Section
Related work we review existing work, while Section
WhatsApp protocol describes the WhatsApp protocol.
Then, in Section Tool for visualizing WhatsApp protocol
messages we describe the tool we created for visualizing
exchanged WhatsApp messages. In Section Decryption, we
describe the process of obtaining decrypted connections
between the WhatsApp client and the WhatsApp server.
Then in Section Findings we examine the message contents
and discuss the meaning of the signaling messages during a
WhatsApp call. Finally, in Section Conclusions, we offer
concluding remarks and outline some future research.
Related work
There has been research conducted on the forensics of
WhatsApp but the majority of that work focused on the
data that WhatsApp stores on the mobile device when
compared to our work which focuses on the network forensics of WhatsApp.
Network protocol forensics
At the time of writing this paper, the work on network
protocol forensics of WhatsApp was sparse. The only work
that provided any detail on WhatsApp's networking protocol was the Hancke (2015) report. Hancke (2015)'s work
focused more on Realtime Transport Protocol (RTP) media
streams (Schulzrinne et al., 2003). The report fails to uncover the call signaling messages used by WhatsApp, which
is elaborated on by our work.
Mobile device forensics
Anglano (2014) performed an in-depth analysis of
WhatsApp on Android devices. The work provided a
comprehensive description of the artifacts generated by
WhatsApp and discussed the decoding, interpretation and
relationship between the artifacts. Anglano (2014) was able
to provide an analyst with the means of reconstructing the
list of contacts and chronology of the messages that have
been exchanged by users.
The works by Thakur (2013) and Mahajan et al. (2013) are
similar to previous studies since they both focused on the
forensic analysis of WhatsApp on Android. These studies
uncovered the forensic acquisition of the artifacts left by
WhatsApp on the device. Thakur (2013) focused on the
forensic analysis of WhatsApp artifacts on an Android phone's
storage and volatile memory. The results showed that one is
able to obtain many artifacts such as phone numbers, messages, media files, locations, profile pictures, logs and more.
Mahajan et al. (2013) analyzed WhatsApp and Viber artifacts
using the Cellebrite Forensic Extraction Device (UFED) toolkit.
They were able to recover contact lists, exchanged messages
and media including their timestamps and call details.
Walnycky et al. (2015) examined 20 different popular
mobile social-messaging applications for Android including
WhatsApp. In their work, they focused on unencrypted
traffic that could be easily reconstructed. WhatsApp was
found to be favorable at encrypting its network traffic when
compared to other mobile social-messaging applications.
Therefore, based on the primarily findings by Walnycky
et al. (2015), our study aimed at further investigating and
dissecting the WhatsApp protocol, and in specific, focusing
on the signaling messages used when establishing WhatsApp calls given this new feature. However, in order to dive
deeper into the signaling messages, one must understand
some known attributes of the WhatsApp protocol which
we discuss in Section WhatsApp protocol below.
WhatsApp protocol
WhatsApp uses the FunXMPP protocol for message exchange which is a binary-efficient encoded Extensible
Messaging and Presence Protocol (XMPP) (WHAnonymous,
2015c). The WhatsApp protocol is also briefly described by
LowLevel-Studios (2012) from an implementation perspective. To fully describe the FunXMPP protocol is beyond this
paper's scope. For more information on the protocol the
readers may want visit a website outlining the protocol.2
Authentication procedure
There are two types of authentication procedures the
WhatsApp client can use when connecting to the servers. If
it is the first time the client is connecting to the server, a full
handshake is performed as illustrated in Fig. 1. Subsequently, for any consecutive connections, only a half
handshake is executed using data provided from the initial
full handshake.
We note that a half handshake therefore results in using
the same session keys multiple times, which can be
deemed as a plausible protocol security weakness.
Full handshake
The authentication procedure as described by the developers of WhatsAPI consists of three messages
(WHAnonymous, 2015a). This is synonymous with the well
known three-way handshake and is described in detail in
the following paragraphs. These messages can be observed
in Fig. 1 which was created using our developed tool (for
more details see Section Tool for visualizing WhatsApp
protocol messages).
As shown in Fig. 1, first, the client sends an <auth>
message to the server. This message is not encrypted and
contains the client number and authentication method the
client wants to use.
Then, the server replies with a <challenge> message
containing a 20 byte long nonce for the session key generation. Session keys are then generated using the PasswordBased Key Derivation Function 2 (PBKDF2) algorithm using
the password as a passphrase and the nonce as a salt. Both
the server and the client know the password and nonce so
the generated keys are the same on both ends. Four keys are
2
https://github.com/WHAnonymous/Chat-API/wiki/FunXMPPProtocol, last accessed 2015-07-03.
Please cite this article in press as: Karpisek F, et al., WhatsApp network forensics: Decrypting and understanding the WhatsApp
call signaling messages, Digital Investigation (2015), http://dx.doi.org/10.1016/j.diin.2015.09.002
F. Karpisek et al. / Digital Investigation xxx (2015) 1e9
3
Fig. 1. Full handshake between WhatsApp client and server. Note: Numbers on the left side represent packet numbers (see Appendix A for the source pcap file).
Also, there can be multiple messages in one packet.
generated in total: two keys for confidentiality (one for each
direction e from the server and to server) and two keys for
the integrity check (again one for each direction).
The client then creates a <response> message that
consists of a concatenated client phone number in ASCII,
nonce sent by the server in binary, current Unix timestamp
in ASCII and other device description data. This message is
encrypted using the generated session keys and it is prepended by the hash of the message for integrity checking
purposes. Decrypted contents of the response message are
illustrated in Fig. 2, where we can see the aforementioned
fields e their hexadecimal value and also the ASCII representation as displayed by Wireshark.
If registration is successful, the server replies with a
<success> message that is encrypted. Otherwise, the server
replies with a <failure> message that is not encrypted.
Half handshake
A half handshake consists only of an <auth> message
that already contains the data of a <response> message
described above, and the server's reply, a <success> message. The client uses the nonce from the earlier session
which means that this nonce is not known by outsiders,
therefore, it is not possible to decrypt such a session, as
session encryption keys cannot be determined.
Tool for visualizing WhatsApp protocol messages
Description
Our tool is a command-line program written in Python
(version 2.7). It is named convertPDML.py as it converts the
PDML file exported from Wireshark to an HTML report. It is
available in the form of source code, see Appendix A for
more details. It requires one input parameter; a path to an
XML file containing the details of dissected packets. See the
step 6 in Section Decryption procedure for details on how
to create the XML file.
The output of the tool is a report file containing all the
messages exchanged between the WhatsApp client and the
WhatsApp servers in HTML format as shown in Fig. 1.
Hence, any standard browser can be used to view the results. Messages are ordered chronologically as they appear
in the input XML file.
Please cite this article in press as: Karpisek F, et al., WhatsApp network forensics: Decrypting and understanding the WhatsApp
call signaling messages, Digital Investigation (2015), http://dx.doi.org/10.1016/j.diin.2015.09.002
4
F. Karpisek et al. / Digital Investigation xxx (2015) 1e9
Fig. 2. Content of <response> message with marked regions.
Usage
As mentioned above, the tool requires am XML file as an
input parameter. Example: convertPDML.py INPUT.xml.
Network traffic collection
This section explains how we collected the WhatsApp
network traffic. More details are presented in Sections
Experimental setup and High level methodology.
Experimental setup
We used the setup exemplified in Fig. 3 for capturing
network traffic between the WhatsApp messenger running
on an Android phone and the WhatsApp servers. The
hardware and software used in the experimental setup are
listed below:
Equipment used in experimental setup:
Phone: Lenovo P780, Android 4.2.1, running
e Whatsapp v2.12.84 which was downloaded from
the Google play store.
e Password Extractor v1.03.
Laptop: Lenovo ThinkPad T420s with Windows 7 64-bit
with the following installed software:
e Wireshark v1.12.5, 32-bit, with the WhatsApp
dissector.4
e Pidgin v2.12.11,5 32-bit, with the WhatsApp plugin.6
application to gain access to the WhatsApp password. We
note that the phone had to be rooted to use this application.
We would also like to mention that there could have been
multiple ways to gain access to the password on the device
such as using commercially available tools to acquire a
forensic image of the phone, and in some cases gaining
access to the password can be achieved without rooting the
phone if the acquisition method allows the investigator to
acquire the image without rooting the device.
We then utilized Pidgin messenger with the WhatsApp
plugin and obtained the WhatsApp password for connecting to the WhatsApp servers in order to desynchronize the
WhatsApp client installed on the Android phone. This was
performed in order for us to capture the full handshake (see
Section Full handshake for more details).
The next step included setting up a wifi access point (see
Fig. 3) on the laptop and sharing the Internet connection
from the Ethernet port to the wifi adapter. The laptop now
acted as a wifi router. We then started capturing all the
traffic on the access point's network. In the next step, we
connected the phone to the created wifi network and made
a WhatsApp call to a user with phone number 1-203-xxxxxxx. Finally, we finished capturing the traffic and saved
the created pcap file.
Following the aforementioned methodology allowed us
to collect network traffic enabling us to perform exploratory analysis. In the following Section Decryption, we
outline the resultant steps that we were able to reproduce
for decrypting the WhatsApp messaging traffic.
Decryption
High level methodology
First, we disconnected the Android phone from any
Internet connection and used the Password Extractor
3
https://www.mgp25.com/downloads/pw.apk, last accessed 2015-07-
06.
4
https://davidgf.net/page/37/whatsapp-dissector-for-wireshark,
accessed 2015-07-06.
5
https://pidgin.im/, last accessed 2015-07-06.
6
https://davidgf.net/whatsapp/, last accessed 2015-07-06.
last
According
to
LowLevel-Studios
(2012)
and
WHAnonymous (2015a), encryption and decryption in
WhatsApp is performed with a symmetric RC4 stream cipher using keys generated during authentication which is
described in the Section Authentication procedure.
Therefore, in order to decrypt the communication between the WhatsApp servers and the WhatsApp client,
session keys for each direction (as WhatsApp uses one key
for communication from device to the server and a
different one for communication from the server to the
Please cite this article in press as: Karpisek F, et al., WhatsApp network forensics: Decrypting and understanding the WhatsApp
call signaling messages, Digital Investigation (2015), http://dx.doi.org/10.1016/j.diin.2015.09.002
F. Karpisek et al. / Digital Investigation xxx (2015) 1e9
5
Fig. 3. Experimental setup.
device) are required. The process of obtaining these keys is
provided in Section Full handshake.
the exchange of WhatsApp protocol's messages between
the WhatsApp client and the servers.
Prerequisites
1. As the Android phone we were using, was rooted,
obtaining the password was as easy as installing and
running an application mentioned in the Section Tools
used. In our case, the username (phone number) was
420xxxxxxxxx with the following extracted password
627XlMqch8i5Ncy2tRSbZLXs2m0¼.
2. After obtaining credentials for the WhatsApp account
(phone number and password), we disconnected the
mobile device running WhatsApp from the wifi network
and used the IM client Pidgin with the WhatsApp plugin
and used the obtained credentials to log into our
WhatsApp account. This broke the synchronization between the WhatsApp client on the mobile device and the
WhatsApp server forcing the client to authenticate using
a full handshake.
3. We then connected the mobile device running the
WhatsApp client back to the wifi access point capturing
all the communication from and to the mobile device as
explained in Section Experimental setup. After the
WhatsApp client logged into the WhatsApp account, we
placed a WhatsApp call to another device. All recorded
communication was saved to a pcap file. Access to the
pcap file is presented in the Appendix A.
4. After we captured all the communication between the
WhatsApp client and the WhatsApp server, we provided
the WhatsApp dissector in Wireshark with the credentials we obtained in the prior steps. To do that we used
Wireshark's menu Edit e> Preferences and in the Protocols section we set up the WhatsApp dissector with
the same options exemplified in Fig. 4.
After setting up the WhatsApp dissector correctly, we were
able to observe the content of encrypted messages and the
content of the <response> message should start with the
number used in <auth> message as shown in Fig. 2.
5. When the communication was decrypted we exported it
to XML format using Wireshark's function File e> Export
Packet Dissections e> as XML e “PDML” (packet details)
file.... We provide access to this XML file in the Appendix
A. Part of this XML file e namely <auth> is illustrated in
Listing 1 where we can see the same values as in <auth>
Our work showed that there are two mandatory requirements for the successful decryption of WhatsApp
messaging connections:
The password associated with the WhatsApp account.
The record of the full handshake between the WhatsApp
client and the server.
Tools used
We outline the list of software tools that were used in
the decryption process:
To obtain the password, there are multiple options
based on the mobile device being used (WHAnonymous,
2015b). As we were using an already rooted Android
phone, the easiest way was to extract the password
using the Password Extractor application.
To force WhatsApp to establish a full handshake the
next time the mobile device connected to the server, it
was necessary to break the synchronization between
the WhatsApp client and the server. The simplest way
for doing that was to connect using a different client. For
that purpose, we used the IM client Pidgin alongside the
WhatsApp plugin.
To decrypt the WhatsApp connection between the client
and server, we used Wireshark and a WhatsApp-specific
dissector.
To visualize the WhatsApp protocol message exchange
we created a command-line tool described in Section
Tool for visualizing WhatsApp protocol messages.
Decryption procedure
In this section, we elaborate using a step-by-step procedure describing how to successfully decrypt and visualize
Please cite this article in press as: Karpisek F, et al., WhatsApp network forensics: Decrypting and understanding the WhatsApp
call signaling messages, Digital Investigation (2015), http://dx.doi.org/10.1016/j.diin.2015.09.002
6
F. Karpisek et al. / Digital Investigation xxx (2015) 1e9
Fig. 4. WhatsApp Wireshark dissector settings.
message from Fig. 1 e attribute user with value
420xxxxxxxxx (lines 33e38) and attribute mechanism
with value WAUTH-2 (lines 39e44).
6. The final step involved using our tool to generate a
report of the WhatsApp message exchange between the
WhatsApp client and WhatsApp servers. For that we
used the XML file generated in the previous step. For
more details refer to the Section Tool for visualizing
WhatsApp protocol messages.
Findings
In the following subsections, we describe our findings
on the signaling messages used for call establishment in
WhatsApp. For a visual representation of our findings
readers may want to refer to Fig. 5.
Protocol analysis of call signaling messages
In this section we elaborate on messages that we hypothesize are part of the establishment of a WhatsApp call
as we observed it in the decrypted captured communication traffic. We used the captured pcap file and the HTML
report generated from the same pcap file (refer to the
Section Decryption procedure for more details). Both of
these files can be downloaded from Appendix A. In the rest
of this section, we refer to the packet numbers displayed on
the leftmost side in the flow diagram of signaling message
exchange in Fig. 5.
First (in packets [8]e[32]), the WhatsApp client connects and authenticates with the first WhatsApp server
174.37.231.87 but there is no activity regarding a call.
Starting with packet [33], the WhatsApp client connects
and authenticates to a second WhatsApp server
174.36.210.45 and starts placing a call.
Right after connecting to the second server, in packet
[41], the client asks for the presence of the called party
Fig. 5. Signaling messages of WhatsApp call (numbers refer to packet
numbers).
Please cite this article in press as: Karpisek F, et al., WhatsApp network forensics: Decrypting and understanding the WhatsApp
call signaling messages, Digital Investigation (2015), http://dx.doi.org/10.1016/j.diin.2015.09.002
F. Karpisek et al. / Digital Investigation xxx (2015) 1e9
(phone number 1-203-xxx-xxxx) and starts the call
establishment process by sending <offer> message to
the called party. This happens in packet [42]. There we
can observe the property call-id¼“1431719979-2” for the
first time. This property remains constant throughout
the rest of the signaling messages during the whole
signaling process and it identifies the call as it is unique
for each call and therefore changes every time a call is
initiated.
In this first message we can also observe that the caller is
offering to use the Opus codec (Valin et al., 2012) (in property <audio>) for voice data in two sampling rates, 8 kHz
and 16 kHz. We also observe the properties <p2p> (value of
16 bytes ¼ 128 bits) and <srtp> (192 bytes ¼ 1536 bits)
values which we were not able to decode. We postulate that
they might be some kind of initialization vectors for
encryption of media streams and/or description of these
streams. The last property is <te> contains a 6 byte value
that we decoded as the endpoint (IP address and port)
where the client announces the endpoint address for the
media stream. Its value is 192.168.137.208:46416.
The server replies with <ack relay> in packet [43] which
contains property <token> (value of 204 bytes ¼ 1632 bits)
which we were also unable to decode, multiple properties
<te> that announce endpoint addresses of relay servers (8
servers in total), and properties <encode>, <agc> (gain
control) and <ns> (noise suppression) that we hypothesize
further specify media encoding.
Packets [44] and [45] carry messages <receipt> and of
the receipt. To the best of our knowledge, these messages
do not contain any data of interest.
Packet [46] going from the server to the client carries the
message <preaccept> and has the property <audio> that
asserts that the used codec for media streams will be the
Opus codec at the sampling rate of 16 kHz. It also contains
the property <srtp> that has the same length as the same
<srtp> property in packet [42] (192 bytes ¼ 1536 bits) but
carries different value.
Packet [47] carries the message <transport> which contains the client's endpoint address but from an external point
of view e a public endpoint address. This address is found out
by the client using Traversal Using Relays around NAT (TURN)
mechanism (Mahy et al., 2010) e client asks the TURN server
what is its (client's) IP address from the outside point of view.
Its value is 64.251.61.74:62334 which differs from the value
in packet [42] e 192.168.137.208:46416. Packet [48] carries
the <ack> message to the previous message.
We can observe a relay server election in packets [49]e
[65]. The client finds out latency between itself and the
relay servers obtained from message <relay> from packet
[43] and one of the servers is elected.
The last message of the call establishment process is
message <accept> in packet [70]. It contains the property
<audio> that confirms that the used codec is Opus, sampling rate 16 kHz, properties <p2p> and <srtp> (with the
same value as in packet [47]) and two endpoint addresses:
private
e
192.168.1.22:55607
and
public
e
64.251.61.74:55607. These endpoint addresses are used
when trying to establish a direct peer-to-peer (P2P)
connection. Packet [71] contains <receipt> message confirming the previous message.
7
After that, both-way media stream is established from
192.168.137.208:46416 to 31.13.74.48:3478 using RTP. These
addresses were announced in a message in packet [42] and
during the relay server election.
After about 30 s of the ongoing call, the client connects
to another WhatsApp server (108.168.180.110) and
signaling messages start flowing through this server. The
client then announces new endpoint addresses in packets
[2688] and [2711] and after a new relay election process, a
new media stream is created replacing the previous one
using a new endpoint address.
Finally, the client connects to another WhatsApp server
(174.37.231.88) and sends two identical messages <terminate> in packets [7921] and [7925] and the call is
terminated.
Media streams
Hancke (2015) mentioned in his report that WhatsApp
uses a codec at 16 kHz sampling rate with bandwidth of
about 20 kbit/s. Unlike us, Philipp Hancke did not have
access to the decrypted signaling messages and thus we can
now declare that WhatsApp is using the Opus codec for
voice media streams at either 8 kHz or 16 kHz sampling
rate which is decided at call setup.
We attempted to decode the media using the opensource implementation of the Opus codec7 but the decoded result was not voice audio. From that and from the
fact that we can observe <srtp> properties (SRTP stands
for Secure Realtime Transport Protocol (Baugher et al.,
2004)) we infer that these media streams are being
encrypted.
Analysis summary
Through the analysis of signaling messages exchanged
during a WhatsApp call we were able to:
Closely examine the authentication process of WhatsApp clients.
Discover what codec WhatsApp is using for voice media
streams e Opus at 8 or 16 kHz sampling rates.
Understand how relay servers are announced and the
relay election mechanism.
Understand how clients announce their endpoint addresses for media streams.
Gaining insight into these signaling messages is essential for the understanding of the WhatsApp protocol
especially in the area of WhatsApp call analysis from a
forensic networking perspective.
Forensically relevant artifacts
As shown in Table 1, forensically relevant artifacts may
be extracted from the network traffic using the outlined
7
http://www.opus-codec.org/, last accessed 2015-07-06.
Please cite this article in press as: Karpisek F, et al., WhatsApp network forensics: Decrypting and understanding the WhatsApp
call signaling messages, Digital Investigation (2015), http://dx.doi.org/10.1016/j.diin.2015.09.002
8
F. Karpisek et al. / Digital Investigation xxx (2015) 1e9
Table 1
Forensically relevant data, their location and sample data.
methodology. Most notably (see Fig. 1), we were able to
acquire the following artifacts from the network traffic:
WhatsApp phone numbers.
WhatsApp phone call establishment metadata and
datetime stamps.
WhatsApp phone call termination metadata and datetime stamps.
WhatsApp phone call duration metadata and datetime
stamps.
WhatsApp's phone call voice codec (Opus).
WhatsApp's relay server IP addresses used during the
calls.
Conclusions
In this work, we decrypted the WhatsApp client
connection to the WhatsApp servers and visualized messages exchanged through such a connection using a
command-line tool we created. This tool may be useful for
deeper analysis of the WhatsApp protocol.
We also uncovered the hypothesized signaling messages of the WhatsApp call which revealed what codec is
being actually used for media transfer (Opus), as well as
forensically relevant metadata about the call establishment, termination, duration and phone numbers associated with the call.
Future work
In this work we were unable to decode media RTP
streams as they seem to be encrypted. However, we hypothesize that encryption keys are most likely being
transferred inside the signaling messages during the set up
of a WhatsApp call and therefore we postulate that it
should be possible, in theory, to decrypt these media
streams as well. The main challenge for this task is to find
out the encryption keys and encryption algorithm used.
We would also like to note that a limitation of our
work is that it was tested on an Android device. Although
we hypothesize that the protocol used in the communication will be constant across platforms, recreating the
experiments with different devices and operating systems running WhatsApp is needed to validate that claim.
Also, we would like to note that as more features are
added to WhatsApp, more experiments need to be conducted to ensure that the design of the protocol does not
change.
We would also like to encourage other researchers to
apply the techniques explained in our work to analyze the
network traffic of other popular messaging applications so
that the forensic community can gain a better understanding of the forensically relevant artifacts that may be
extracted from the network traffic, and not only the data
stored on the devices.
Please cite this article in press as: Karpisek F, et al., WhatsApp network forensics: Decrypting and understanding the WhatsApp
call signaling messages, Digital Investigation (2015), http://dx.doi.org/10.1016/j.diin.2015.09.002
F. Karpisek et al. / Digital Investigation xxx (2015) 1e9
Appendix A. Reference files
These are files that were used throughout this paper.
These files can be provided to researchers by visiting our
website http://www.unhcfreg.com under Tools & Data.
whatsapp_register_and_call.pcap e pcap file containing
user with phone number 420xxxxxxxxx connecting to
multiple WhatsApp servers and placing a call to the user
with phone number 1-203-xxx-xxxx.
whatsapp_register_and_call.xml e content of previous
pcap file exported from Wireshark in XML format.
whatsapp_register_and_call.html e HTML file that was
generated from previous XML file using our tool.
convertPDML.py e command-line tool for converting
XML files exported from Wireshark to a visual HTML
report containing flow of WhatsApp messages exchanged
between WhatsApp Messenger and the WhatsApp
servers.
References
Anglano C. Forensic analysis of whatsapp messenger on android smartphones. Digit Investig 2014;11:201e13. URL, http://www.sciencedirect.
com/science/article/pii/S1742287614000437 [last accessed 06.07.15].
Arce N. Whatsapp calling for android and IOS: How to get it and what to
know. 2015. URL, http://www.techtimes.com/articles/38291/20150309/
whatsapp-calling-for-android-and-ios-how-to-get-it-and-what-toknow.htm [last accessed 27.05.15].
9
Baugher M, McGrew D, Naslund M, Carrara E, Norrman K. The secure realtime transport protocol (SRTP). 2004. URL, https://www.ietf.org/rfc/
rfc3711.txt [last accessed 06.07.15].
Hancke P. Whatsapp exposed: Investigative report. 2015. URL, https://
webrtchacks.com/wp-content/uploads/2015/04/WhatsappReport.pdf
[last accessed 03.06.15].
LowLevel-Studios. Whatsapp protocol 1.2: a brief explanation. 2012. URL,
http://lowlevel-studios.com/whatsapp-protocol-1-2-a-briefexplanation/ [last accessed 03.06.15].
Mahajan A, Dahiya M, Sanghvi H. Forensic analysis of instant messenger
applications on android devices. 2013. arXiv preprint arXiv:1304.4915,.
URL, http://arxiv.org/abs/1304.4915 [last accessed 06.07.15].
Mahy R, Matthews P, Rosenberg J. Traversal using relays around NAT
(TURN). 2010. URL, https://tools.ietf.org/html/rfc5766 [last accessed
06.07.15].
Schulzrinne H, Casner S, Frederick R, Jacobson V. RTP: a transport protocol
for real-time applications. 2003. URL, https://www.ietf.org/rfc/
rfc3550.txt [last accessed 06.07.15].
Thakur NS. Forensic analysis of WhatsApp on android smartphones
(Master's thesis). University of New Orleans; 2013. URL, http://
scholarworks.uno.edu/td/1706/ [last accessed 06.07.15].
Valin J, Vos K, Terriberry T. Definition of the opus audio codec. 2012. URL,
http://tools.ietf.org/html/rfc6716 [last accessed 06.07.15].
Walnycky D, Baggili I, Marrington A, Moore J, Breitinger F. Network and
device forensic analysis of android social-messaging applications.
Digit Investig 2015;14:S77e84.
WHAnonymous. Authentication overview (WAUTH 2). 2015. URL, https://
github.com/WHAnonymous/Chat-API/wiki/AuthenticationOverview-(WAUTH-2. https://github.com/WHAnonymous/Chat-API/
wiki/Authentication-Overview-(WAUTH-2) [last accessed 03.06.15].
WHAnonymous. Extracting password from device. 2015. URL, https://
github.com/WHAnonymous/Chat-API/wiki/Extracting-passwordfrom-device [last accessed 12.06.15].
WHAnonymous. Funxmpp-protocol. 2015. URL, https://github.com/
WHAnonymous/Chat-API/wiki/FunXMPP-Protocol [last accessed
03.06.15].
Please cite this article in press as: Karpisek F, et al., WhatsApp network forensics: Decrypting and understanding the WhatsApp
call signaling messages, Digital Investigation (2015), http://dx.doi.org/10.1016/j.diin.2015.09.002
