Viber Communication Security - Bad Request

Experiments Chapter 3
Android
In Android Viber has multiple xml files which all contain little information, in those xml files the
following can be found:
• Viber account version number
• A ‘dm_registration’ key number (used for the android market)
• Your ‘device key’ (hash)
• Last registered number (your own number)
• Your Viber User ID (hash)
• A ‘Sync hash’
• Last message token ID
• Last mist call log
• Your activation code (the one you get through SMS)
3.1.3 Conclusion of Viber’s data stored
Is seems that everything you do with Viber gets stored inside a database. Viber makes use of the
SQLite database with some xml files for different kind of data. Both Android and iOS need to be
rooted and jailbreaked to gain access to them. All Viber databases and files are stored unencrypted
or could be said in normal plaintext. The data in the xml files is used for the configuration of
the application. The data inside the database look like log files and only stores messages plus your
address-book. Photos called attachments in the database are saved in a separated directory. But
there can be concluded that your Viber data is easily accessible on your phone both on Android and
iOS.
Database
The databases contain on both os’s all Viber contacts but on iOS also your normal address-book can
be found. All messages send and received are stored with tables for your location (if that function
is on). Both databases have a list of calls received and made. It’s also interesting that on Android
every message has his own token and sequence numbers attached to it while iOS only stores the
sequence numbers. Both databases contain a table with summaries on how many message are send
and calls are made. The iOS database also looks better organised than the one on Android. Android
has two more databases than iOS. Maybe they ‘viber_hashes’ database which also can be found
in Android was used in a previous version of Viber. Below you can compare how the messages are
stored in both databases:
You can see Android uses the token value while iOS doesn’t. Android further in the table also has
a sequence value which is being filled. But iOS on the other hand only has a sequence value filled
14