6

I was wondering if its possible to obtain private keys for Whatsapp to be able to sniff traffic between two WhatsApp Android devices (both under my control). I understand that WhatsApp traffic is now end-to-end-encrypted, and I have read their technical paper where they describe the encryption used. But is the Message Key (used for encryption) stored somewhere on the client-side where I could obtain it? Can this key be later used to decrypt traffic going out from my device? So far I've tried to root one of the devices and installed "Shark For Root" to see what kind of traffic is passing through. However, I want to be able to see the application-level data that is traveling encrypted between the two devices, could anyone please suggest ways I could do this? I wanted to understand how WhatsApp works and what kind of data is being transferred through. Thanks.

Improve this question
7
  • Do you have physical access to both devices?
    – Rápli András
    Feb 6, 2017 at 6:21
  • Yes, I do. But only one of them is rooted.
    – QPTR
    Feb 6, 2017 at 6:24
  • Whatsapp uses some standard protocol, you should find out what is this protocol and try from there.
    – Aria
    Feb 6, 2017 at 12:19
  • Yep, but the thing is I don't know which particular way to proceed. Should I decompile WhatsApp and go from there? Any recommendations?
    – QPTR
    Feb 9, 2017 at 11:21
  • 1
    I remember a french team who presented a framework on the yearly CCC a few years back that could be used to view and manipulate all app variables during runtime on Android. This will help you find the symmetric encryption key. Surely, that key is stored in the system storage (not SD card), and you have a chance finding it, at least after disassembling the APK.
    – Anton Kaiser
    Feb 10, 2017 at 22:20

1 Answer 1

Reset to default
1

Take a look at this paper here. They also provide the PCAP file used in the research here.

The password file should be stored at /data/data/com.whatsapp/files/pw.

However, if you are not root, you may want to use this trick to access it:

  • Install Android SDK
  • Open cmd
  • Change your directory and go into 'Platform tools'
  • Type 'adb shell'
  • su
  • Press 'Allow' on device
  • chmod 777 /data /data/data /data/data/com.whatsapp /data/data/com.whatsapp/*

Also, you can use this application to retrieve the password (also needs root)

Improve this answer
5
  • 2
    Link-only answers are only useful for as long as the link lives. Please include the relevant parts of the link in your answer.
    – schroeder ♦
    Apr 4, 2017 at 18:43
  • @schroeder Agreed. I'll edit my post.
    – Filipe Rodrigues
    Apr 4, 2017 at 18:46
  • 1
    I can't find the pw file/directory. Did Whatsapp change the password file?
    – motis10
    Jan 23, 2018 at 22:39
  • Does this decryption method also works with latest whatsup (2018) ?
    – ransh
    Dec 19, 2018 at 19:09
  • How about in 2020? Has this changed?
    – auspicious99
    Jun 14, 2020 at 7:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.