WhatsApp encrypts messages using the RC4 protocol and obtains a hash from either a user's IMEI number on Android or MAC address on iPhone. However, WhatsApp initially sends some identifying information such as a user's phone number in plain text, which could allow others to intercept this data on unsecured networks. It is recommended to use a VPN when sending WhatsApp messages on public Wi-Fi networks to help prevent this type of interception.

1. How does WhatsApp
send your messages over
the net?
BY JAVIER HURTADO

2. Whatsapp security protocol
 WhatsApp encrypts messages since versión 2.8.3 (2012)
 WhatsApp uses the RC4 protocol to encrypt messages
 Android:
 Reversed MD5 hash
 IMEI
 iPhone:
 MAC Address
 MD5 hash

3. Obtaining hash in Android
IMEI: 012345678912345 =>

4. Obtaining hash in iPhone
MAC Address: AA:BB:CC:EE:FF=>

5. WhatsApp security bug
 First it sends a plain text packet with:
 Client OS
 WhatsApp app version
 Port used for the message transmission (encrypted)
 443
 5222
 5223
 YOUR PHONE NUMBER

6. WhatsApp security bug (iPhone)

7. WhatsApp security bug (Android)

8. Precautions
 Preferably do not use WhatsApp on public WiFi networks (cafes, airports…)
 If there isn’t other option use a VPN