WhatsApp has now adopted the end-to-end encryption for your messages this year, as well as iMessages, but a security researcher says that both still have a security flaw which can allow that deleted messages are recovered, whether from the device, or remotely from the iCloud backups. Jonathan Zdziarski found the flaw in the current version of WhatsApp.
The last version of the application tested leaves trace “forensic” of all them chats, even after remove, delete or archive them, even if deleted all them chats. In fact, the only way to get rid of them, seems to be completely remove the application.
Zdziarski says that data are stored without matter which method of disposal was used: archive, delete or remove conversations, and indicates that the same defect is present in the application of iOS messages, iMessage.
The forensic trail is common in any application that uses SQLite, since default way SQLite as database in iOS. When you delete a record, added simply to a “free list”, but the free records are not overwritten until later, when the database need extra storage (usually after many more records are created). In other applications, I’ve often seen information that remains in the database for months.
iMessage Apple has this problem and is just as bad, if not worse. Its sms.db is stored in a backup from iCloud, but there are also copies of it on your iPad, MacBook, and anywhere else that receive messages from iMessage. The removed content also suffers the same fate.
For the average user risks are very low. Retrieving data it would require to be unlocked access to a device, or access to the backup of iCloud. In practice, unless you are a suspect in a criminal case, when a court order may compel Apple to provide a copy of the backup of iCloud to a law enforcement agency, the only risk would be the same type of phishing attack that led to the release of nude photos of celebrities.
The iCloud backups are encrypted, but still not used end-to-end encryption, so it can be deciphered by Apple. This is something that the company has indicated that it plans to change, hopefully soon.
