The Wireshark recording shows that also TCP packets are sent from the iOS client to WhatsApp servers. This is confirmed by the structure of UDP packets exchanged between WhatsApp clients. We know that WhatsApp applies SRTP for protecting calls. Probably the payload of the inspected packet contains audio data of the call. The remaining bytes represent the payload. It is an identifier used for distinguishing call sessions running in parallel. The four bytes after that (green) represent the synchronization source ( SSRC). The next four bytes (blue) represent the timestamp of the packet. This recommendation is not applied by WhatsApp, since the packet sequence numbers are increased from zero, as can be seen from the Wireshark recordings. The RTP standard recommends to randomize the initial value of the sequence number. The last 17 bits contain the sequence number ( SEQ) of the given packet. It might be a custom value chosen by WhatsApp. The given packet type is not defined by the RTP or SRTP standard. The next six bits contain the packet type ( PT), which is equal to the decimal value 60 in this case. It can be used to mark frame boundaries of the packet stream. Also the marker bit ( M) at position 9 is set to zero. CSRCs are a list of identifiers indicating which sources contributed to the payload of an SRTP packet. Bits at position five to eight, the CSRC count ( CC), show that no contributing source ( CSRC) identifiers follow the fixed header. The fourth bit, the extension field ( X), indicates that no other header follows the fixed RTP header. The third bit, the padding field ( P), indicates that there is no padding included in the packet. The first two bits contain the RTP version ( V) which is equal to version two in this case. There are also many TCP and UDP packets in the Wireshark recording, which could not be related with a high-level protocol.

STUN is a signaling protocol which handles necessary steps for establishing a peer-to-peer connection between clients. Wireshark detects the usage of the Session Traversal Utilities for NAT (STUN).

The shell command is as follows (works on MacOS), where has to be replaced with the UUID of the inspected iOS device: rvictl -s For recording the network traffic of the iOS device, I created a remote virtual network interface. This part examines the network traffic of the WhatsApp client during a call, which was recorded with Wireshark. How I installed a Jailbreak on my iOS device is out of scope.

Disassembling binary files: Hopper Disassembler and radare2.

I used the following tools for analyzing an iOS WhatsApp client: Consequently, there is no foundation for serious security related analysis. While there is an official white paper describing the encryption of WhatsApp, there is no detailed overview of how its protocols work or how the security features are implemented. So it is an interesting target for teaching security analysis. WhatsApp got a lot attention due to security vulnerabilities and hacks. In this article I want to demonstrate how I revealed parts of the WhatsApp VoIP protocol with the help of a jailbroken iOS device and a set of forensic tools.

Hopper disassembler reference strings