Re:How to decrypt WhatsApp end-to-end media files
by londons_explore on Monday February 03, 2020 @10:11AM
(#22224780)
It's possible the forensics experts couldn't extract the video encryption key because the malware itself had decided to corrupt/remove it.
It would make sense - if you're distributing a (very expensive) zero day exploit to a target, you want to make sure that as soon as the exploit code runs and leaves the payload, the exploid code is removed and scrubbed, and any evidence of how the payload got there is hidden or removed. Deliberately changing the encryption key stored in whatsapps message database would be a good way to do that, as would locking down backups, usb ports, and generally things that make forensics difficult.
Re:How to decrypt WhatsApp end-to-end media files
by admax88q on Monday February 03, 2020 @12:17PM
(#22226279)
Sure its possible, but if they were actually forensics "experts" then they would have been able to explain exactly what you did. That the decryption key was removes from the device.
It would make sense - if you're distributing a (very expensive) zero day exploit to a target, you want to make sure that as soon as the exploit code runs and leaves the payload, the exploid code is removed and scrubbed, and any evidence of how the payload got there is hidden or removed. Deliberately changing the encryption key stored in whatsapps message database would be a good way to do that, as would locking down backups, usb ports, and generally things that make forensics difficult.