Reverse Engineering WhatsApp Encryption for Chat Manipulation and More

## Overview

Oded Vanunu and Roman Zakian (Israeli security researchers) presented reverse engineering of WhatsApp's end-to-end encryption protocol to enable chat manipulation attacks. Motivation: WhatsApp supports 1.5 billion users with 56 billion messages daily across 1 billion groups—massive platform vulnerable to misinformation and fake news campaigns. While end-to-end encryption prevents third-party eavesdropping and network-level interception, vulnerability exists at application layer: if attacker gains control over their own client connection (via reverse engineering or application manipulation), they can inject false messages, manipulate existing messages, or spoof sender identity. Research goal: fully reverse engineer WhatsApp Web's protocol to extract session keys from encrypted traffic, enabling message manipulation from attacker's own authenticated connection. Specific target: WhatsApp Web (desktop client synced with phone) which depends on phone as backend—connection requires active phone but can be manipulated from PC. Key finding: WhatsApp's encryption (Signal's Open Whisper System for E2E, Protocol Buffers for serialization) is cryptographically sound, but key derivation process contains exploitable application logic—attackers reverse engineering client library can derive session keys and manipulate messages before encryption, appearing authentic to recipients.

## WhatsApp Architecture and Key Derivation

**Authentication and Secret Exchange**: WhatsApp Web requires QR code scan to establish trust: (1) Phone generates elliptic-curve public/private key pair (curve25519 variant); (2) QR code encodes public key; (3) WhatsApp Web scans QR, displays prompt on phone; (4) User confirms on phone, phone transmits "secret" (144 bytes) to Web via websocket containing encrypted session setup parameters. Secret contains three encoded components: (1) shell secret (first 2 bytes, labeled "N")—initial ECDH ephemeral key material; (2) data portion (remaining bytes, labeled "A")—encrypted session parameters; (3) concatenation marker ("S")—separates shell from data. Key exchange relies on shared elliptic-curve private key known only to phone and web client.

**HKDF-Based Key Expansion**: Session key derivation via HMAC-based key derivation function (HKDF): (1) Shell secret (N) + private key → HKDF extract/expand → 80-byte expanded secret; (2) Expanded secret divided: first 32 bytes (AES key), next 32 bytes (HMAC authentication tag), last 16 bytes (encrypted data payload). Authentication verification: (1) Compute HMAC-SHA256(HMAC-value, [shell-secret || data-portion]); (2) Compare computed HMAC with HMAC-value from expanded secret; (3) HMAC mismatch indicates private-key corruption or tampering, abort connection. Purpose of HMAC: detect if private key has changed (which would produce different expanded secret and mismatched HMAC), preventing successful key derivation by impersonated client.

**Session Key Extraction and Message Manipulation**: Upon HMAC verification success: (1) AES-256-decrypt concatenated [data-from-expanded || data-from-original-secret] using AES key from expanded secret; (2) Decryption yields final session keys (used for encrypting/decrypting all chat messages) plus additional authentication parameters; (3) Attacker now possesses valid session keys to encrypt/decrypt messages using Signal protocol as legitimate client. Attack implementation: (1) Intercept 144-byte secret during WhatsApp Web initialization; (2) Extract shell secret and encrypted data; (3) Derive AES key via HKDF using known private key; (4) Decrypt data portions → obtain session keys; (5) Use session keys to decrypt incoming messages or forge new messages appearing from attacker's identity; (6) Manipulated messages encrypted with correct session key pass authentication checks on recipient's client.

## Exploitation Impact and Message Manipulation Scenarios

**Attack Vectors**: (1) Chat injection—inject false messages into conversations appearing from attacker's verified account, spreading misinformation at scale; (2) Message modification—intercept outgoing messages, modify content (e.g., change payment instructions, alter group invites), re-encrypt with correct key before sending; (3) Sender spoofing—derive session keys for target user's conversations, forge messages appearing from target (requires compromised phone access); (4) Group manipulation—inject messages into group chats from compromised account, affecting up to thousands of group members; (5) Business logic abuse—manipulate payment/transactional messages, order confirmations, or authentication codes if transmitted via WhatsApp. Scale: single compromised WhatsApp Web session can manipulate all outgoing messages from that account plus access to group chats affecting hundreds of users per group. Persistence: manipulation possible as long as session keys remain valid (can be hours to days depending on WhatsApp session timeout policies). Detection difficulty: manipulated messages cryptographically valid (correct HMAC, correct encryption) from legitimate account, indistinguishable from genuine messages to recipient clients or platform servers.