dinsdag 24 mei 2011

Whatsapp security weaknesses

The facts of whatsapp and all the drama.

In case of an iPhone if you open the Whatsapp application the following occurs:
- The application resolves sro.whatsapp.net.
- Gets the addresses 173.192.219.141, 173.192.219.149, 173.192.219.140 back from: ns1.softlayer.com
- An encrypted(!) connection is set up on port 443 with (in this case) 173.192.219.141.
Unfortunately I haven’t been able to perform a MITM attack to decrypt the data send between these two senders. So I don’t know what data is transported between them
- Through this encrypted(!) connection the ip-adres of the Whatsapp-chat servers is send, in this case: 50.22.227.220. Whatsapp uses the Extensible Messaging and Presence Protocol, but than it’s own version of it.
- From this moment on Whatsapp communicates via port 5222 met de Whatsapp XMPP-server 50.22.227.220. And simultaneously keeps the encrypted connection open. Remarkable about this is that al the messages send via the Whatsapp application are send without encryption over port 5222. In plaintext, as stated. The data transported contains sensitive data as names and corresponding telephone numbers are transported in plaintext as well.

For sending pictures Whatsapp uses mms.whatsapp.net and this time it does send the data encrypted.

The Android, Nokia and Blackberry way.
Above is the way the Whatsapp iPhone application works. The Android, Nokia and Blackberry applications work different. In their case Whatsapp does exactly the same, only difference is that instead of port 5222 it connects to port 443. People say this way Whatsapp suggests it uses an encrypted connection, since port 443 is mainly associated with encrypted HTTP traffic. If this is the case can be questioned, since they didn’t implement this way of connecting in the iPhone application it suggests that using port 443 on these devices has a good motivated reason.

We should not forget that encrypting your messages will make the application slower, the transport of the messages slower, and will eat your battery.
Despite that it is not necessary to transfer username and telephone numbers. Instead user-id’s and phone-id’s can be used.

Concerning these security weaknesses in Whatsapp, the application had another big flaw that allows account hijacking. For details on this subject see my previous blog: http://rickey-g.blogspot.com/2011/05/hijack-someone-elses-whatsapp-with-your.html
Since it possible to spoof sms messages, Whatsapp can fix this problem only by disabling all other verification methods other than sending a verification sms themselves.

85 opmerkingen:

  1. Ik wilde het net zelf even testen en idd: de inhoud van WhatApp berichten in Wireshark. Ik vraag me al een tijdje af of het mogelijk is om een client te bouwen voor op de pc. Denk je dat dit mogelijk is? Aangezien ook de sms-verificatie is gekraakt.. Makkelijkste lijkt me om bijvoorbeeld de Android app te decompilen aangezien dit JAVA is. Let me know what you think
    - Herman

    BeantwoordenVerwijderen
  2. Ja, dat is zeker mogelijk als je de whatsapp packets namaakt.
    Ik denk dat het ook mogelijk is om een client te maken die namens andere personen berichten kan sturen.
    Spam is dus ook een optie via whatsapp. (denk ik)

    BeantwoordenVerwijderen
  3. het is echt nuttig informatie, maar ik wil een vraag stellen.

    voor whatsapp berichten sinds whatsapp wordt met behulp van veel ip-adressen dus hoe kan ik whatsapp berichten te detecteren? door welke parameter dat het verschilt van adder en andere applicatie?

    dank

    BeantwoordenVerwijderen
  4. Thanks for sharing info. Keep up the good work...We hope you will visit our blog often as we discuss topics of interest to you
    WhatsApp on PC

    BeantwoordenVerwijderen
  5. Thanks blackhatthacker@gmail.com for the great and perfect hack service you provided for me. helping check on my husband's infidelity. She helped me hack his cell phone number and I was a blessing to listen to every calls in real time and also provided his email password, redirected his whatsApp messages and I was also reading all his chats with his mistress and text messages. It was all worth the time. I know there are many people like me out there. Contact her directly via email blackhatthacker@gmail.com

    BeantwoordenVerwijderen
  6. I am undeniably thankful to you for providing us with this invaluable related information. My spouse and I are easily grateful, quite frankly the documents we needed.
    real time file transfer

    BeantwoordenVerwijderen
  7. Nice post,Everyone , I just thought I'd let you know you can have a talented hacker get your jobs done for you , whatever you need done , reach him on CYBERSHADOW76@GMAIL.COM , let him know Oliver told you


    - See All Photos Captured.
    - Hack facebook messages, viber chats, yahoo messenger.
    - Track Line messages and BBM messages.
    - Spy SMS text messages remotely.
    - Track Call history and Spy Call Recording.
    - Read phone contact and Track Internet Browsing History.
    - 100% Undetectable and Free Update.
    - Track whatsapp messages without rooting.
    - Track mobile phone GPS location.

    BeantwoordenVerwijderen
  8. http://number-whatsapp.blogspot.com/

    BeantwoordenVerwijderen
  9. so nice i like whatsapp connection details check out here some whatsapp dp attitude images i find this website though searching for some cool whatsapp images for my dp have check

    BeantwoordenVerwijderen
  10. There's a chance you're qualified to get a Apple iPhone 7.

    BeantwoordenVerwijderen
  11. get the best iphone covers from Caselogy.com in your budget price.......

    BeantwoordenVerwijderen
  12. For safe weight loss, at the rate of just one 1 pound
    a week, women and men have to create a calorie deficit of 500
    calories daily, either by eating less, ramping up their exercise, or doing a mixture of both https://adamfantacy.tumblr.com/

    BeantwoordenVerwijderen
  13. After recently issuing its third revenue warning in a year, Adidas stated on Thursday it could increase spending on advertising and marketing to about thirteen percent of sales in 2014 and to between 13 and 14 p.c of sales in 2015. vectorvines.webgarden.com

    BeantwoordenVerwijderen
  14. Ok. If you are looking to buy phone cases then visit stylebaby.

    BeantwoordenVerwijderen
  15. I posted this article to my favorites and intend to return to for more outstanding articles.
    It’s all too easy to read and comprehend and
    also clever post. I definitely enjoyed my first read throughout this post. Have a look at:Whatsapp Dares.

    BeantwoordenVerwijderen
  16. Hello, this weekend is pleasant in favor of me, as this moment i am reading this wonderful educational post here at my house.discount nfl jerseys My Blog http://megaworld.beep.com/

    BeantwoordenVerwijderen
  17. I’ve been absent for some time, but now I remember why I used to love this blog. Thanks , I will try and check back more often. How frequently you update your website? My Blog http://http://mclubarena.wallinside.com

    BeantwoordenVerwijderen
  18. Shree Ram Techno Solutions Provides CCTV Camera, Security Camera, Wireless Security, Attendance System, Access Control System, DVR, NVR, Spy Camera, Fire Alarm, Security Alarm, PCI, IP Network Camera, Dome Camera, IR Camera, CCTV, Camera Price, HIKVISION, SCATI, Time Machine

    CCTV CAmera in jaipur at Rajasthan
    Home security system in jaipur
    Wireless Home Security System in jaipur
    Realtime attendance machine in jaipur
    cctv camera dealer in jaipur
    Hikvision DVR in jaipur at Rajasthan
    security system solutions in jaipur

    BeantwoordenVerwijderen
  19. Programs like Auto - CAD work best about the Dell Precision M6400 that Intel Quad-Core and, an extraordinary, 16GB RAM. With a wealthy blend of creativity and innovation it has come with such immensely popular computers and laptop products. Best lightweight pc laptop Laptops will be in a huge demand today and nobody wants to get a full size desktop. However, the most notable 10 accredited colleges for fast degrees provide students with options to earn accelerated degrees quicker than traditional degrees. When I asked to myself “where can I sell my laptop and acquire some cash. My Blog http://filmyroll.webpaper.co/

    BeantwoordenVerwijderen
  20. Useful article for people who do not understand anything in modern technology and software. It is very simple and affordable even for young children. Who cares, I found a software for tracking the phone http://copy9.com/whatsapp-hack/. Very useful for parents who do not believe their children and want to know the truth.

    BeantwoordenVerwijderen
  21. Just WoW! Thanks for sharing this awesome post. Will you please guide me to write more frequently on my blog about whatsapp dp and whatsapp status collection.

    BeantwoordenVerwijderen
  22. Thanks a lot dear. Happy New Year 2018 in advance. Have you any collection regarding happy new year 2018 images or love status, If yes, then do let me know please. :)

    BeantwoordenVerwijderen
  23. I want to appreciate and sincerely thank blackhatthacker@gmail.com for her service...She saved me from the lies of my cheating husband. She was able to hack his whatssp messages, listen to every call he either made or receive, hacked his email passwords and Facebook ...i know there are lots of people out there looking for proof and evidence about one thing or the other . Be open and real with her so she can even be at the best of her service to you. Do contact her by email on blackhatthacker@gmail.com

    BeantwoordenVerwijderen
  24. i felt i was being cheated on by my husband and talked to some friends about it and i was referred to Binary H. who helped me hack my husbands mobile phone giving me unrestricted access to the phone.i caught him cheating with a co worker from text messages i saw and also followed up on their conversation and on their next meeting i caught them on the act. All thanks to Binary H. if you are ever in need of a hacker you can contact him and tell him i referred you for swift response.

    Contact : Binaryhacker016@gmail.com

    BeantwoordenVerwijderen
  25. شركة تنظيف كنب بالمدينة 0502030035 شركة رواد المدينه


    شركة تنظيف كنب بالمدينة خطوات ما قبل التنظيف قبل البدء بتنظيف الكنب .

    يلزم شفط كل الأشياء والأوساخ العالقة فيه والمُتراكمة على الزّوايا باستِخدام المكنسة الكهربائيّة.

    إزاحة الأقمشة من الوسائد إذا أمكن الشأن وغسلها في الغسّالة، وتركها لتجف تحت أشعة الشمس.

    إزاحة الغبار العالق بالكنب بضربه بواسطة قطعة قماش، وقومي بمسح الغبار عن الأجزاء الخشبية إن وجدت.

    والتأكّد ايضا من تنظيفها بمُنتجات التنظيف المناسبة، وإذا قد كانت مساحة الأسطح الصلبة والخشبيّة واسعةً .

    فقومي بمسحها بقطعة قماش قطنية مبللة. استخدمي فرشاة الشعر الخشن .

    إذا قد كانت هنالك أي بُقع أو أوساخ للتخلّص منها. أزيلي الوبر والفراء في حال بقاء حيوان أليف في المنزل .

    عن طريق استعمال أسطوانة إزاحة الوبر. حاجز دي نوع النسيج لتعرفي أسلوب التنظيف.

    والمحلول الذي يلزم أن تستخدميه في التنظيف. الكنب الأوروبي تأتي قائمة معه تُوضح أسلوب تنظيفه.

    مثلاً لو كان نموزج التنظيف يوميء إلى الحرف S فإنّه يدل على استعمال المنظفات الجافة لاغير.

    https://rowd-almadena.com/2017/05/02/شركة-تنظيف-كنب-بالمدينة0502030035/

    https://rowd-almadena.com/2017/03/09/افضل-شركة-تنظيف-بالمدينة-المنورة/

    BeantwoordenVerwijderen
  26. It’s really a great and helpful piece of information. I’m satisfied that you
    shared this useful information with us. Please stay us informed like
    this. Thanks for sharing.
    Whatsapp Dares
    Happy Raksha Bandhan 2017
    Happy Raksha Bandhan SMS for Whatsapp
    Happy Raksha Bandhan Photos Wallpapers

    BeantwoordenVerwijderen
  27. Hello everyone! If you require the service of a professional hacker to help track your partner's cell phone remotely, contact deadlyhacker01@gmail.com, after being ripped off by various hackers, he helped me track my husband's phone without physical contact.
    Tell him Stacey referred you, he'd help

    BeantwoordenVerwijderen
  28. Ik heb je blog bekeken. Ziet er goed uit.

    Keep it up!!


    BeantwoordenVerwijderen
  29. Hi Dear,

    i Like Your Blog Very Much..I see Daily Your Blog ,is A Very Usefull For me.


    You Can see also my services.....


    Bison security provide CCTV camera system in London. We have hikvision HD CCTV camera for Security solutions are available as sale or rental packages.



    Visit Now - Hikvision
    -----------

    BeantwoordenVerwijderen
  30. I have read many blogs but your blog are always very nice and now here I got some detail about the Hijackers on Your Amazon it's Good work keep it up.
    Hijackers on Your Amazon

    BeantwoordenVerwijderen
  31. Ik weet echt niet over dit scam-ding. Maar een vriend heeft me voorgesteld aan een goede hacker die me hielp met de boodschappen van mijn vriendjes en whatsapp, viber, twitter, facebook-berichten. Hij creëerde zelfs sleutelwoorden zoals seks en liefde dus ik wist precies wat er gebeurde ... ik moest zijn telefoon niet aanraken terwijl ik toegang heb tot zijn gesprekken. Contact: hackculture1987@gmail.com

    BeantwoordenVerwijderen
  32. Anti-Shop Lifting Systems. Through our strategic partnerships with world class manufacturers, we have constructed the most comprehensive catalogue of digital surveillance equipment and other security related products available to dealers and security professionals in South India
    Melbourne Security & Alarm Systems

    BeantwoordenVerwijderen
  33. Hello,be warned, most of these so called hackers here are impostors, I know how real hackers work, they never advertise themselves in such a credulous manner and they are always discrete. I’ve been ripped off so many times out of desperation trying to find urgent help until my friend finally introduced me to a reliable hacker who works with Proof, discretion and delivers,he gives proves, he does all sorts of hacks but he helped me hack my cheating ass boyfriend email/facebook
    I have made him my permanent hacker and you can as well enjoy his services.You can contact him at mitchbourne(@)cyberservices.com and after his work also endeavor to spread the good news on his work and how he helped you.

    BeantwoordenVerwijderen
  34. Hello everyone, I have tried zingzong@zeushacker.info and i have confirmed her good work among all of this hackers out there ,she helped me hack my cheating partner whatsapp, facebook and cell phone number. I listened to all his calls and I was able to get good evidence for my attorney for divorce. It was really a big surprise to me but glad I gave a try. Contact her for similar issues on zingzong@zeushacker.info and consider your big problem solved

    BeantwoordenVerwijderen
  35. Have you ever been curious of what your partner, kids or employees are up to? You can now intercept cell phones, boost credit scores and hack any website remotely. All you need to do is contact a verified hacker Helpline: +1 (347)-857-7580 Email: extremeinfiltrators@gmail.com

    BeantwoordenVerwijderen
  36. I've just used this guy's services and he's a legit black hat hacker, mobile phone hack, social network hacks, emails and school grade hacks, he's actually the real deal, I was initially skeptical as I already got scammed before but he did come through, his email is eightspyders@gmail.com

    BeantwoordenVerwijderen
  37. FIFA World Cup 2018 Official Theme Song Video, Mp3 Download- With pretty much 3 years before football’s greatest holiday commences in Russia, fans far and wide have been given an essence of what’s in store with the arrival of the official signature song for the 2018 FIFA World Cup ‘We Are Racists’
    FIFA World Cup Theme Song
    FIFA World Cup 2018 Theme Song

    BeantwoordenVerwijderen
  38. I hate cheaters, my fiancee never gave me a reason to be suspicious until i found her and her colleague at a romantic restaurant. she told me it was work stuff but something wasn’t right.
    i was worried until i was introduced to cyberlasar@gmail.com who hacked her phone and text so i can find out the truth.
    cyberlasar@gmail.com made it possible to track her movement and location. he hacked her facebook, aol email.
    now lets say i have no doubt her was cheating. Email him he can help. He also does so many other hacks like
    facebook, whatsapp, bank, School result upgrade,credit card,paypal,skype,Snapchat,Calls... just name it

    BeantwoordenVerwijderen
  39. Many WANT TO BE ONLINE HACKERS BEWARE OF THEM, IF YOU NEED GENUINE AND PROFESSIONAL HACKERS SERVICES, CONTACT SOLUTIONHACKERS95@GMAIL.COM
    They are a professional hacking group based in U S A, TURKEY, INDIAN AND EUROPE, They are the best hackers and also software developers to penetrate all websites, all other hackers contact them for the best Algorithm Software. Their services are 100% guaranteed too, with their penetration software unreachable. They offer the following services;
    - illegal card hacking
    -Removal of the old credit score
    -University of change of notes
    -Bank accounts hack
    -Procedures of crime
    -Facebook hack
    -Tweitters hack
    - personal mail accounts
    -Grade Changes hack
    - Policy blocked on site
    -server crashed hack
    -Skype hack
    -Dates hack
    -Word Press Blogs hack
    - Individual Computers
    -Control devices remotely
    -Burner Numbers hack
    - Verified Paypal accounts pirate
    - Any social network account you make
    -Auto and iPhone Hack
    Text message intercept text
    - Trapping in the mail
    - credit card for free online transactions
    Credit Card and Credit Card Blank Atm
    -Intraceable Ip etc.
    Contact SOLUTIONHACKERS95@GMAIL.COM
    NOTE they are the solution to all your hacking problem

    BeantwoordenVerwijderen
  40. Many WANT TO BE ONLINE HACKERS BEWARE OF THEM, IF YOU NEED GENUINE AND PROFESSIONAL HACKERS SERVICES, CONTACT SOLUTIONHACKERS95@GMAIL.COM
    They are a professional hacking group based in U S A, TURKEY, INDIAN AND EUROPE, They are the best hackers and also software developers to penetrate all websites, all other hackers contact them for the best Algorithm Software. Their services are 100% guaranteed too, with their penetration software unreachable. They offer the following services;
    - illegal card hacking
    -Removal of the old credit score
    -University of change of notes
    -Bank accounts hack
    -Procedures of crime
    -Facebook hack
    -Tweitters hack
    - personal mail accounts
    -Grade Changes hack
    - Policy blocked on site
    -server crashed hack
    -Skype hack
    -Dates hack
    -Word Press Blogs hack
    - Individual Computers
    -Control devices remotely
    -Burner Numbers hack
    - Verified Paypal accounts pirate
    - Any social network account you make
    -Auto and iPhone Hack
    Text message intercept text
    - Trapping in the mail
    - credit card for free online transactions
    Credit Card and Credit Card Blank Atm
    -Intraceable Ip etc.
    Contact SOLUTIONHACKERS95@GMAIL.COM
    NOTE they are the solution to all your hacking problem

    BeantwoordenVerwijderen
  41. Many WANT TO BE ONLINE HACKERS BEWARE OF THEM, IF YOU NEED GENUINE AND PROFESSIONAL HACKERS SERVICES, CONTACT SOLUTIONHACKERS95@GMAIL.COM
    They are a professional hacking group based in U S A, TURKEY, INDIAN AND EUROPE, They are the best hackers and also software developers to penetrate all websites, all other hackers contact them for the best Algorithm Software. Their services are 100% guaranteed too, with their penetration software unreachable. They offer the following services;
    - illegal card hacking
    -Removal of the old credit score
    -University of change of notes
    -Bank accounts hack
    -Procedures of crime
    -Facebook hack
    -Tweitters hack
    - personal mail accounts
    -Grade Changes hack
    - Policy blocked on site
    -server crashed hack
    -Skype hack
    -Dates hack
    -Word Press Blogs hack
    - Individual Computers
    -Control devices remotely
    -Burner Numbers hack
    - Verified Paypal accounts pirate
    - Any social network account you make
    -Auto and iPhone Hack
    Text message intercept text
    - Trapping in the mail
    - credit card for free online transactions
    Credit Card and Credit Card Blank Atm
    -Intraceable Ip etc..,.
    Contact SOLUTIONHACKERS95@GMAIL.COM
    NOTE they are the solution to all your hacking problem

    BeantwoordenVerwijderen
  42. Candidates who are anxiously looking for the fresh notification of the Reliance JIO Recruitment 2018 Application Form can visit the main web website. Candidates can check here the all the essential information. The Application form will be started, as per the official notification the last will be available soon. Hurry UP … ! Apply as soon as or by last date.

    BeantwoordenVerwijderen
  43. I’m from United States, My husband divorced me 3 years ago for no reason, i did all i could to get him but didn't work, until i met Dr.Agbazara of AGBAZARA TEMPLE on the internet who helped me to cast a re-union spell and within 24hours my husband came back to me apologizing. Thanks to Dr.agbazara. Contact this great spell caster on your relationship or marriage problems on:
    ( agbazara@gmail.com ) OR WHATSAPP: +2348104102662.

    BeantwoordenVerwijderen
  44. I strongly recommend the service of a GREAT Hacker to you and his email is hackersolution89@gmail.com. I have used him quite a number of times and he has never disappointed me.


    He does all types of mobile hacks, get unrestricted and unnoticeable access to your Partner/Spouse, Skype, Facebook Account, Email(s), Whatsapp, Instagram, Text messages, In coming and Out going calls, Twitter, Snap Chats, Bank accounts, Deleted files etc. He can also help you boost your credit score limit and also clear all debts on your card(s).

    Getting the job done is as simple as sending an email to hackersolution89@gmail.com stating what you want to do.

    BeantwoordenVerwijderen
  45. BlueHost is ultimately one of the best web-hosting company with plans for any hosting needs.

    BeantwoordenVerwijderen