MODIFYING WHATSAPP MESSAGES FOR DUMMIES

MODIFYING WHATSAPP MESSAGES FOR DUMMIES

EDITING WHATSAPP CONTENTS ON A NON JAILBREAK IPHONE OR HOW TO FOOL FORENSIC EXPERTS REPORTS.


WHO AM I▸ Abraham Pasamar (@apasamar)

▸ INCIDE CEO

▸ Over 10 years hands-on experience as a Digital Forensic Investigator, Researcher, eDiscovery Consultant and Expert Witness

▸ Over 300 Expert Witness Reports and over 100 testify in court

▸ Experience in managing Computer Incidents, Internal Fraud, Data Loss and other Incidents in complex environments and high-profile cases. Both from a technical and client management perspective


WHATSAPP NUMBERS▸ 2009 -> 2016

▸ 0 -> 1 BILLION USERS !!!

▸ 2014 -> sold to facebook

▸ 19.000 MM $


WHATSAPP NUMBERS▸ 2009 -> 2016

▸ 0 -> 1 BILLION USERS !!!

▸ 2014 -> sold to facebook

▸ 19.000 MM $


WHATSAPP SCREENSHOTS▸ iOS: Home + Sleep/Wake button

▸ Android: Volume Down + Power button











WHATSAPP SCREENSHOTS AS A DIGITAL EVIDENCE















can be faked !!!


WHATSAPP IN THE SPANISH COURTS

▸ Case number 300/2015

▸ On May 19, 2015 Spanish Criminal High Court establishes the criteria to accept the probative value of screenshots or “snapshots"


WHATSAPP IN THE SPANISH COURTS

▸ The high court stated that it possible to simulate a communication in which a single user interacts with himself.

▸ It is essential to request an expert to run a forensic analysis of the contents and to provide an expert witness report.


EXPERT WITNESS REPORT

▸ An expert in applying scientific, technical or medical knowledge to the purposes of law

▸ Computer forensics expert report

IS IT POSSIBLE TO MODIFY WHATSAPP MESSAGES?


▸ Strong end-to-end encryption

IS IT POSSIBLE TO MODIFY WHATSAPP MESSAGES?


▸ There are many articles written by security researchers describing how to modify whatsapp messages from a rooted or jailbroken device.


HOW TO MODIFY WHATSAPP MESSAGES▸ In a rooted or jailbroken device, it is

possible to access directly the Whatsapp DATABASE, and use SQL commands to modify any message.

SQLITE DATABASE


WHAT CAN A FORENSIC EXPERT DO TO DETECT A JAILBREAK▸ There are a lot of

indicators to detect a Jailbreak:

▸ Presence of APPs (i.e. cydia, terminal, etc)

▸ Shell access

▸ Several files in filesystem


WHAT IF THE EXPERT DETECTS A JAILBREAK

▸ Messages may have been modified, but maybe not

▸ The expert should look for traces of alteration

▸ Even in the case of not finding any evidences, it is possible that the messages have been modified.

▸ In this case, forensic experts are usually not able to be conclusive on the results


WHAT HAPPENS IF THE DEVICE HAS NOT BEEN JAILBROKEN

▸ Expert can not access to the whole filesystem

▸ It is not possible to perform an extensive analysis

▸ Only the ‘backup’ files can be analyzed


WHAT DOES THE EXPERT CONCLUDE IN THIS CASE?

▸ most experts will certainly be able to assess the integrity of the messages


WHAT DOES THE EXPERT CONCLUDE IN THIS CASE?

▸ most experts will certainly be able to assess the integrity of the messages


WHY?

▸ Because IT IS POSSIBLE to modify whatsapp messages in a NO-JAILBROKEN device


WHY?

▸ Because IT IS POSSIBLE to modify whatsapp messages in a NO-JAILBROKEN device


HOW ?


HOW ?


YES, YOU GOT IT !


BACKUP IS THE KEY


WHATSAPP DATABASE BACKUP IS NOT ENCRYPTED


WHATSAPP DATABASE BACKUP IS NOT ENCRYPTED

AND THERE IS NO BACKUP MODIFICATION CONTROL


IT’S DEMO TIME


CONCLUSIONS

▸ Local backup modifications are posible

▸ No ease to fix, only if backup is related to the Device

▸ Forensic experts can be fooled

Technology

MODIFYING WHATSAPP MESSAGES FOR DUMMIES