3 ms·

Interesting! Google's Project Zero team investigated WhatsApp's and Facetime's video conferencing last year: "Overall, WhatsApp signalling seemed like a promi

Interesting! Google's Project Zero team investigated WhatsApp's and Facetime's video conferencing last year: "Overall, WhatsApp signalling seemed like a promising attack surface, but we did not find any vulnerabilities in it. There were two areas where we were able to extend the attack surface beyond what is used in the basic call flow. First, it was possible to send signalling messages that should only be sent after a call is answered before the call is answered, and they were processed by the receiving device. Second, it was possible for a peer to send voip_options JSON to another device. WhatsApp could reduce the attack surface of signalling by removing these capabilities." "Using this setup, I was able to fuzz FaceTime calls and reproduce the crashes. I reported three CVEs in FaceTime based on this work." WhatsApp: https://googleprojectzero.blogspot.com/2018/12/adventures-in-video-conferencing-part-4.html https://googleprojectzero.blogspot.com/2018/12/adventures-in... Facetime: https://googleprojectzero.blogspot.com/2018/12/adventures-in-video-conferencing-part-2.html https://googleprojectzero.blogspot.com/2018/12/adventures-in... In both cases, the close source nature of the applications stymied their efforts. Looks like NSO was willing to spend more time and resources!

pvg 7y ago
In both cases, the close source nature of the applications stymied their efforts. Why do you say that? In the WhatsApp case, they were able to repeatedly modify the code and also yank it out and run it in their own controlled environment, etc.
- criley2 7y ago
  From my experience, working with real source from the repo with comments etc is very different than working with reverse engineered binaries. That's probably what they're referring to.
  - pvg 7y ago
    The post says "the close[d] source nature of the applications stymied their efforts" not "finding security bugs is harder than not-finding security bugs". I didn't read anything in the linked post that supports the former statement, the latter one (or variants) seems obvious.
ec109685 7y ago
NSO wasn't the group that did the WhatsApp hack. They are the software the hacker installs after they exploit has been found.
Relys 7y ago
I literally just attended Natalie Silvanovich's talk at Infiltrate. Very interesting work.

pvg 7y ago

In both cases, the close source nature of the applications stymied their efforts. Why do you say that? In the WhatsApp case, they were able to repeatedly modify the code and also yank it out and run it in their own controlled environment, etc.

criley2 7y ago
From my experience, working with real source from the repo with comments etc is very different than working with reverse engineered binaries. That's probably what they're referring to.
- pvg 7y ago
  The post says "the close[d] source nature of the applications stymied their efforts" not "finding security bugs is harder than not-finding security bugs". I didn't read anything in the linked post that supports the former statement, the latter one (or variants) seems obvious.

ec109685 7y ago

NSO wasn't the group that did the WhatsApp hack. They are the software the hacker installs after they exploit has been found.

Relys 7y ago

I literally just attended Natalie Silvanovich's talk at Infiltrate. Very interesting work.