It's been a long time since I've had a post about forensics. 🔎
Today I want to show you a cool article about Signal encrypted traffic analysis 🔑
Since its communication data is encrypted, it becomes difficult or often impossible to get the plaintext because the keys are unknown.
The article below demonstrates how artifacts of potential value can be extracted from analysis of encrypted network traffic .
The Signal application encrypts all messages using the Signal protocol .Recently, well-known IM applications such as
WhatsApp, Facebook Messenger and Skype (in private conversation mode) use the Signal Protocol.
The protocol consists of the Double Ratchet algorithm, XEdDSA and VXEdDSA, X3DH and Sesame. XEdDSA creates a key pair that is used in elliptic Diffie-Hellman curve and signatures. VXEdDSA is an extension of XEdDSA to turn it into a verifiable random function (VRF) . X3DH (extended Diffie-Hellman) is used for mutual user authentication and provides direct secrecy .After sharing a shared secret key, messages are
transferred between users using the Double Ratchet encryption algorithm . For message session management, Sesame (asynchronous session management) with Double Ratchet and X3DH algorithms is used.
As can be understood , due to the encrypted payload, only packet sizes, packet frequencies and repeating packet patterns can be used. Therefore, certain payload sizes can help to identify specific types of activity
General analysis of packet sizes (patterns, frequencies) can identify "suspicious" application activity. To identify traffic patterns associated with related activities. Let's understand what data we can, and should, find in general:
User A is the target device on which the actions
His corresponding actions in the application are as follows: 1) Access/open Signal app, 2) Typing patterns on the target device, 3) Typing patterns of User B, 4) Call initiated by User A (caller), 5) Call received by User A (caller), 6) Media messages, 7) Video calls.In the article below, getting information about each user action item is explained in detail, with clear screenshots in wireshark and a good explanation .
And that's it . I hope you found this article interesting and useful 🎯.
Also, about the "big posts" I have not forgotten about the post about phones or viruses, and so far I am gradually making them, and will release them soon ❤️And remember , even if the sleepy mouse likes to sleep during tea time , she can still tell you a story✨🐭
#traffic_analysis #network #messenger #mobile #forensics