How Cloning May Have Helped Access WhatsApp Chats in Sushant Rajput Case

Can authorities access your WhatsApp account? This question might come to your mind after seeing the news stories that the Narcotics Control Bureau (NCB) summoned Deepika Padukone and other actors in the drug probe related to the Sushant Singh Rajput death investigation based on WhatsApp chats. The chats were sourced from the mobile phone of talent manager Jaya Saha. But how are those chats retrieved from the phone? Many believe that it all happened using mobile phone cloning. This isn’t a new technique as it has existed for years.

Mobile phone cloning has been in place for quite some time, with cases registered against bad actors cloning phones in India dated back in 2005. It is a technique through which the data and the cellular identity of the phone being cloned is copied to a new phone. Although cloning phones isn’t legal for individuals, authorities go through a forensic way to legitimately access user data stored on phones using a similar method. The process also enables transferring of the International Mobile Station Equipment Identity (IMEI) number that is unique in nature.

Experts in the domain highlight that phone cloning requires programming skills and just a few minutes of time to copy the entire identity data from one device to another. Earlier, physical access of the phone was required for copying data. This is, however, not mandatory in the world of smartphones as an app can be used for cloning the phone — without touching the phone.

Once the cloning process is done, WhatsApp chats appear to be accessed on the new phone by using one of recent backups stored on the cloud, either on Google Drive or on iCloud — depending on which phone, Android or iPhone, you have. When a phone number or SIM card associated with a particular account is used to register the account on a new phone, WhatsApp sends an temporary code via SMS or phone call to the phone number — which theoretically will be received by the cloned SIM. Users can also set up two-step verification, with a 6-digit passcode apart from the temporary code required, to potentially prevent such abuse.

It is important to note WhatsApp chats are encrypted on your phone, and end-to-end encrypted in transmission. But that’s not the case with WhatsApp backups as those aren’t encrypted by the Facebook-owned company.

WhatsApp in one of its FAQ posts mentions that its backups are tied to the phone number and Google account they were created on. This means that it is not that easy for anyone to extract your chats from a backup. However, phone cloning seems to allow transferring of chats from a recent backup. Huawei has provided a workaround specifically for its phones where users can move WhatsApp data from its backup using the preloaded Phone Clone app.

Gadgets 360 reached out to WhatsApp for clarity on whether it is possible to access chats from a backup using the phone cloning technique and received the following statement from a WhatsApp spokesperson.

“WhatsApp protects your messages with end-to-end encryption so that only you and the person you’re communicating with can read what is sent, and nobody in between can access it, not even WhatsApp. It’s important to remember that people sign up on WhatsApp using only a phone number, and WhatsApp doesn’t have access to your message content. WhatsApp follows guidance provided by operating system manufacturers for on-device storage and we encourage people to take advantage of all the security features provided by operating systems such as strong passwords or biometric IDs to prevent third parties from accessing content stored on device.”

Should the government explain why Chinese apps were banned? We discussed this on Orbital, our weekly technology podcast, which you can subscribe to via Apple Podcasts, Google Podcasts, or RSS, download the episode, or just hit the play button below.