Viber Communication Security - Bad Request

Experiments Chapter 3
3 Experiments
In this chapter different approaches are documented which were used to try and reveal any weaknesses
in the application.
3.1 Local Storage
For a mobile communication application it is not only important to secure data which is send or
received from your phone. But also what kind information gets stored and kept on it. Suppose your
phone gets stolen or lost, what may other people retrieve or find on it? In this chapter will be looked
in the files that Viber stores on your phone. What information can be gained from it? Viber not
only uses a database but also uses some Extensible Markup Language (xml) files where it stores
data in.
3.1.1 Database
Viber uses a database to store different kind of information. Viber makes use of a so called SQLite
database for storing their data. The first thing that could be noticed was that everything was
unencrypted and you could access the database fairly easily, once you have access on a phone of
course. Since the implementation can differ between Operating System (os) we will look closer into
Android and iOS and then end with a short conclusion about what can be found.
iOS
It was easy to locate and access the SQLite database on an iOS phone. You only need to jailbreak your
phone. All data is stored into a single database. Only the important data that could be interesting
or important for this project is mentioned. The following information is stored in plaintext inside
the iOS database:
• Your whole address-book (even non-Viber users)
• Other address-book with Viber contacts (phone number and name)
• All messages that have been send plus the current location
• All calls made and received
• A list with links to attachment (pictures)
• Log file for missed and received calls
• Your Viber user ID
• A table which counts/summarise all above
12