<story><title>How to decrypt WhatsApp end-to-end media files</title><url>https://blog.erratasec.com/2020/01/how-to-decrypt-whatsapp-end-to-end.html</url></story><parent_chain></parent_chain><comment><author>londons_explore</author><text>It&amp;#x27;s possible the forensics experts couldn&amp;#x27;t extract the video encryption key because the malware itself had decided to corrupt&amp;#x2F;remove it.&lt;p&gt;It would make sense - if you&amp;#x27;re distributing a (very expensive) zero day exploit to a target, you want to make sure that as soon as the exploit code runs and leaves the payload, the exploid code is removed and scrubbed, and any evidence of how the payload got there is hidden or removed.   Deliberately changing the encryption key stored in whatsapps message database would be a good way to do that, as would locking down backups, usb ports, and generally things that make forensics difficult.</text></comment>
<story><title>How to decrypt WhatsApp end-to-end media files</title><url>https://blog.erratasec.com/2020/01/how-to-decrypt-whatsapp-end-to-end.html</url></story><parent_chain></parent_chain><comment><author>kdeldycke</author><text>Another tool which was posted on HN a couple of days ago to demonstrates how to decrypt encrypted media files downloaded from WhatsApp: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;ddz&amp;#x2F;whatsapp-media-decrypt&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;ddz&amp;#x2F;whatsapp-media-decrypt&lt;/a&gt;</text></comment>