WhatsApp Network Forensics: Decrypting and Understanding the WhatsApp Call Signaling Messages

WhatsApp is a widely adopted mobile messaging application with over 800 million users. Recently, a calling feature was added to the application and no comprehensive digital forensic analysis has been performed with regards to this feature at the time of writing this paper. In this work, we describe how we were able to decrypt the network traffic and obtain forensic artifacts that relate to this new calling feature which included the: a) WhatsApp phone numbers, b) WhatsApp server IPs, c) WhatsApp audio codec (Opus), d) WhatsApp call duration, and e) WhatsApp\u27s call termination. We explain the methods and tools used to decrypt the traffic as well as thoroughly elaborate on our findings with respect to the WhatsApp signaling messages. Furthermore, we also provide the community with a tool that helps in the visualization of the WhatsApp protocol messages

Jonathan Demmes Spielfilm

Der Kulturphilosoph Heinz Robert Schlette hat 1977 die „Agenten des Marginalismus“ dazu aufgerufen, sich wieder in den „Text“ hineinzuwagen. Sie könnten auf diesen humanisierend einwirken. Der „Text“ ist das vom Menschen „Gemachte“. Im bisherigen Gesamtwerk des Regisseurs Jonathan Demme findet man große Studioproduktionen (z.B.:THE SILENCE OF THE LAMBS, 1991), aber auch zahlreiche Dokumentar- und Performancefilme (z.B.: STOREFRONT HITCHCOCK, 1997). Der Auteur sucht in verschiedenen Projekten die Begegnung mit dem Menschen an der Peripherie. Diese Bewegung an den Rand und wieder zurück, die der Regisseur wiederholt vollzieht, ist auch charakteristisch für jene, die Schlette seinen Agenten abverlangt. In seinen Spielfilmen aktiviert Demme schließlich Randfiguren, die mit Eigenschaften ausgestattet sind, die er an der Peripherie gefunden hat. Er bringt damit Verwirrung in den Narrationsraum und damit in den zentralen Bereich des Filmtextes. SWING SHIFT (1984), mit Goldie Hawn in der Hauptrolle, wurde für den Regisseur zum Fiasko. Ohne die Zustimmung des Regisseurs wurden in der Postproduktion Szenen neu gedreht und angeordnet. Seitdem besteht Demme in seinen Spielfilmen auf eine „mise-en-scène“, deren Kernmotiv der „Anti-Starfilm“ sein könnte. Über die Zonen der Credits-Sequenzen, Vorworte und Anmerkungen rücken Randfiguren an den „Text“ heran. Diese möglichen Agenten errichten im und am Zentrum Rückzugsorte des „Soseins“, die auf eine Alternative verweisen und damit auf einen „Text“, der verändert werden kann. Durch dieses Einschreiten wird nicht nur der Hauptdarsteller als der klassische Filmstar herausgefordert. Von SOMETHING WILD (1986) bis zu RACHEL GETTING MARRIED (2008) variiert Demme Einsatzmöglichkeiten. Das führt zu unterschiedlichen Ergebnissen, die nicht immer einen Erfolg darstellen

Leveraging the SRTP Protocol for Over-the-Network Memory Acquisition of a GE Fanuc Series 90-30

Programmable Logic Controllers (PLCs) are common components implemented across many industries such as manufacturing, water management, travel, aerospace and hospitals to name a few. Given their broad deployment in critical systems, they became and still are a common target for cyber attacks; the most prominent one being Stuxnet. Often PLCs (especially older ones) are only protected by an outer line of defense (e.g., a firewall) but once an attacker gains access to the system or the network, there might not be any other defense layers. In this scenario, a forensic investigator should not rely on the existing software as it might have been compromised. Therefore, we reverse engineered the GE-SRTP network protocol using a GE Fanuc Series 90-30 PLC and provide two major contributions: We first describe the Service Request Transport protocol (GE-SRTP) which was invented by General Electric (GE) and is used by many of their Ethernet connected controllers. Note, to the best of our knowledge, prior to this work, no publicly available documentation on the protocol was available affording users\u27 security by obscurity. Second, based on our understanding of the protocol, we implemented a software application that allows direct network-based communication with the PLC (no intermediate server is needed). While the tool\u27s forensic mode is harmless and only allows for reading registers, we discovered that one can manipulate/write to the registers in its default configuration, e.g., turn off the PLC, or manipulate the items/processes it controls

Validation and verification of predictive salivary biomarkers for oral health

WOS:000632046500002PubMed: 33742017Oral health is important not only due to the diseases emerging in the oral cavity but also due to the direct relation to systemic health. Thus, early and accurate characterization of the oral health status is of utmost importance. There are several salivary biomarkers as candidates for gingivitis and periodontitis, which are major oral health threats, affecting the gums. These need to be verified and validated for their potential use as differentiators of health, gingivitis and periodontitis status, before they are translated to chair-side for diagnostics and personalized monitoring. We aimed to measure 10 candidates using high sensitivity ELISAs in a well-controlled cohort of 127 individuals from three groups: periodontitis (60), gingivitis (31) and healthy (36). The statistical approaches included univariate statistical tests, receiver operating characteristic curves (ROC) with the corresponding Area Under the Curve (AUC) and Classification and Regression Tree (CART) analysis. The main outcomes were that the combination of multiple biomarker assays, rather than the use of single ones, can offer a predictive accuracy of > 90% for gingivitis versus health groups; and 100% for periodontitis versus health and periodontitis versus gingivitis groups. Furthermore, ratios of biomarkers MMP-8, MMP-9 and TIMP-1 were also proven to be powerful differentiating values compared to the single biomarkers.European UnionEuropean Commission [633780]; Karolinska InstitutetKarolinska Institutet; Baden-Wuerttemberg Ministry of Science, Research and Art; University of FreiburgThis study was funded by the European Union's Horizon 2020 research and innovation programme under grant agreement No 633780 ("DIAGORAS" project) and was partially supported by strategic funds from Karolinska Institutet. The article processing charge was funded by the Baden-Wuerttemberg Ministry of Science, Research and Art and the University of Freiburg in the funding programme Open Access Publishing. We would like to thank all the study participants who donated samples

Sensing multimedia contexts on mobile devices

We use various multimedia applications on smart devices to consume multimedia content, to communicate with our peers, and to broadcast our events live. This paper investigates the utilization of different media input/output devices, e.g., camera, microphone, and speaker, by different types of multimedia applications, and introduces the notion of multimedia context. Our measurements lead to a sensing algorithm called MediaSense, which senses the states of multiple I/O devices and identifies eleven multimedia contexts of a mobile device in real time. The algorithm distinguishes stored content playback from streaming, live broadcasting from local recording, and conversational multimedia sessions from GSM/VoLTE calls on mobile devices.Peer reviewe

Platelet-derived chemokines, PF-4 and RANTES, are significantly increased in hemodynamically significant degenerative aortic stenosis

Aortic valve stenosis (AoS) is the most common acquired valvular disorder found in developed countries, being present in 2% to 7% of adults over the age of 65 [1], [2] and [3]. Calcified AoS is a chronic progressive disease. The pathomechanisms leading to valve degeneration remain unknown. Valve disease shares many features with atherosclerosis. Platelet activation is an important constituent of the atherosclerotic process [4] and [5]. The study focused on two platelet-derived chemokines, which bridge three important components of atherogenesis: platelet activation, inflammation, and generation of atheroma. The study group was comprised of 124 consecutive patients being considered for aortic valve replacement for symptomatic degenerative trileaflet valvular AoS, and were undergoing cardiac catheterization in the Cardiocentre (Table 1) [6]. The exclusion criterion was the presence of an additional hemodynamically significant valve disease