FAQin Congress - 5/3/2016 EDITING WHATSAPP CONTENTS ON A NON JAILBREAK IPHONE OR HOW TO FOOL FORENSIC EXPERTS REPORTS. Video at slide 38 ! and also here: DEMO VIDEO: https://youtu.be/9BTMQSqJy_I

1. MODIFYING WHATSAPP
MESSAGES FOR DUMMIES
EDITING WHATSAPP CONTENTS ON A NON JAILBREAK
IPHONE OR HOW TO FOOL FORENSIC EXPERTS REPORTS.

2. MODIFYING WHATSAPP MESSAGES FOR DUMMIES
WHO AM I
▸ Abraham Pasamar (@apasamar)
▸ INCIDE CEO
▸ Over 10 years hands-on experience as a Digital Forensic
Investigator, Researcher, eDiscovery Consultant and Expert
Witness
▸ Over 300 Expert Witness Reports and over 100 testify in court
▸ Experience in managing Computer Incidents, Internal Fraud,
Data Loss and other Incidents in complex environments and
high-profile cases. Both from a technical and client
management perspective

3. MODIFYING WHATSAPP MESSAGES FOR DUMMIES
WHATSAPP NUMBERS
▸ 2009 -> 2016
▸ 0 -> 1 BILLION USERS !!!
▸ 2014 -> sold to facebook
▸ 19.000 MM $

4. MODIFYING WHATSAPP MESSAGES FOR DUMMIES
WHATSAPP NUMBERS
▸ 2009 -> 2016
▸ 0 -> 1 BILLION USERS !!!
▸ 2014 -> sold to facebook
▸ 19.000 MM $

5. MODIFYING WHATSAPP MESSAGES FOR DUMMIES
WHATSAPP SCREENSHOTS
▸ iOS: Home + Sleep/Wake button
▸ Android: Volume Down + Power button

6. MODIFYING WHATSAPP MESSAGES FOR DUMMIES
WHATSAPP SCREENSHOTS
▸ iOS: Home + Sleep/Wake button
▸ Android: Volume Down + Power button

7. MODIFYING WHATSAPP MESSAGES FOR DUMMIES
WHATSAPP SCREENSHOTS
▸ iOS: Home + Sleep/Wake button
▸ Android: Volume Down + Power button

8. MODIFYING WHATSAPP MESSAGES FOR DUMMIES
WHATSAPP SCREENSHOTS
▸ iOS: Home + Sleep/Wake button
▸ Android: Volume Down + Power button

9. MODIFYING WHATSAPP MESSAGES FOR DUMMIES
WHATSAPP SCREENSHOTS AS A DIGITAL EVIDENCE

10. MODIFYING WHATSAPP MESSAGES FOR DUMMIES
WHATSAPP SCREENSHOTS AS A DIGITAL EVIDENCE

11. MODIFYING WHATSAPP MESSAGES FOR DUMMIES
WHATSAPP SCREENSHOTS AS A DIGITAL EVIDENCE

12. MODIFYING WHATSAPP MESSAGES FOR DUMMIES
WHATSAPP SCREENSHOTS AS A DIGITAL EVIDENCE

13. MODIFYING WHATSAPP MESSAGES FOR DUMMIES
WHATSAPP SCREENSHOTS AS A DIGITAL EVIDENCE

14. MODIFYING WHATSAPP MESSAGES FOR DUMMIES
WHATSAPP SCREENSHOTS AS A DIGITAL EVIDENCE

15. MODIFYING WHATSAPP MESSAGES FOR DUMMIES
WHATSAPP SCREENSHOTS AS A DIGITAL EVIDENCE

16. MODIFYING WHATSAPP MESSAGES FOR DUMMIES
WHATSAPP SCREENSHOTS AS A DIGITAL EVIDENCE
can be faked !!!

17. MODIFYING WHATSAPP MESSAGES FOR DUMMIES
WHATSAPP IN THE SPANISH COURTS
▸ Case number 300/2015
▸ On May 19, 2015 Spanish Criminal High Court
establishes the criteria to accept the probative value of
screenshots or “snapshots"

18. MODIFYING WHATSAPP MESSAGES FOR DUMMIES
WHATSAPP IN THE SPANISH COURTS
▸ The high court stated that it possible to simulate a
communication in which a single user interacts with
himself.
▸ It is essential to request an expert to run a forensic
analysis of the contents and to provide an expert witness
report.

19. MODIFYING WHATSAPP MESSAGES FOR DUMMIES
EXPERT WITNESS REPORT
▸ An expert in applying scientific, technical or medical
knowledge to the purposes of law
▸ Computer forensics expert report

20. IS IT POSSIBLE TO MODIFY WHATSAPP MESSAGES?
MODIFYING WHATSAPP MESSAGES FOR DUMMIES
▸ Strong end-to-end encryption

21. IS IT POSSIBLE TO MODIFY WHATSAPP MESSAGES?
MODIFYING WHATSAPP MESSAGES FOR DUMMIES
▸ There are many articles written by
security researchers describing how t
modify whatsapp messages from a
rooted or jailbroken device.

22. MODIFYING WHATSAPP MESSAGES FOR DUMMIES
HOW TO MODIFY WHATSAPP MESSAGES
▸ In a rooted or jailbroken device, it is
possible to access directly the
Whatsapp DATABASE, and use SQL
commands to modify any message.
SQLITE
DATABASE

23. MODIFYING WHATSAPP MESSAGES FOR DUMMIES
WHAT CAN A FORENSIC EXPERT DO TO DETECT A JAILBREAK
▸ There are a lot of
indicators to detect a
Jailbreak:
▸ Presence of APPs (i.e.
cydia, terminal, etc)
▸ Shell access
▸ Several files in
filesystem

24. MODIFYING WHATSAPP MESSAGES FOR DUMMIES
WHAT IF THE EXPERT DETECTS A JAILBREAK
▸ Messages may have been
modified, but maybe not
▸ The expert should look for traces
of alteration
▸ Even in the case of not finding any
evidences, it is possible that the
messages have been modified.
▸ In this case, forensic experts are
usually not able to be conclusive
on the results

25. MODIFYING WHATSAPP MESSAGES FOR DUMMIES
WHAT HAPPENS IF THE DEVICE HAS NOT BEEN JAILBROKEN
▸ Expert can not access to the whole filesystem
▸ It is not possible to perform an extensive analysis
▸ Only the ‘backup’ files can be analyzed

26. MODIFYING WHATSAPP MESSAGES FOR DUMMIES
WHAT DOES THE EXPERT CONCLUDE IN THIS CASE?
▸ most experts will certainly be able to assess the integrity
of the messages

27. MODIFYING WHATSAPP MESSAGES FOR DUMMIES
WHAT DOES THE EXPERT CONCLUDE IN THIS CASE?
▸ most experts will certainly be able to assess the integrity
of the messages

28. MODIFYING WHATSAPP MESSAGES FOR DUMMIES
WHY?
▸ Because IT IS POSSIBLE to modify whatsapp messages
in a NO-JAILBROKEN device

29. MODIFYING WHATSAPP MESSAGES FOR DUMMIES
WHY?
▸ Because IT IS POSSIBLE to modify whatsapp messages
in a NO-JAILBROKEN device

30. MODIFYING WHATSAPP MESSAGES FOR DUMMIES
HOW ?

31. MODIFYING WHATSAPP MESSAGES FOR DUMMIES
HOW ?

32. MODIFYING WHATSAPP MESSAGES FOR DUMMIES
YES, YOU GOT IT !

33. MODIFYING WHATSAPP MESSAGES FOR DUMMIES
BACKUP IS THE KEY

34. MODIFYING WHATSAPP MESSAGES FOR DUMMIES
WHATSAPP DATABASE BACKUP IS NOT ENCRYPTED

35. MODIFYING WHATSAPP MESSAGES FOR DUMMIES
WHATSAPP DATABASE BACKUP IS NOT ENCRYPTED
AND THERE IS NO BACKUP MODIFICATION
CONTROL

36. MODIFYING WHATSAPP MESSAGES FOR DUMMIES
IT’S DEMO TIME

37. MODIFYING WHATSAPP MESSAGES FOR DUMMIES
CONCLUSIONS
▸ Local backup modifications are
posible
▸ No ease to fix, only if backup is
related to the Device
▸ Forensic experts can be fooled