3 ms·

Two separate issues: https://bugs.chromium.org/p/project-zero/issues/detail?id=1936 https://bugs.chromium.org/p/project-zero/issues/detail?id=19... webrtc dat

Two separate issues: https://bugs.chromium.org/p/project-zero/issues/detail?id=1936 https://bugs.chromium.org/p/project-zero/issues/detail?id=19... webrtc data being handled before call answered, problematic in theory, Moxie can't get webrtc upstream to fix it (https://twitter.com/moxie/status/1180226374851710976 https://twitter.com/moxie/status/1180226374851710976), not fixed yet. https://bugs.chromium.org/p/project-zero/issues/detail?id=1943 https://bugs.chromium.org/p/project-zero/issues/detail?id=19... State machine bug in Signal app, you can send the callee the message the caller gets when the callee answers and the callee will think the call has started and enable the mic. No user interaction, but with log and indication (https://twitter.com/moxie/status/1180261210341511168 https://twitter.com/moxie/status/1180261210341511168), fixed same day.

loeg 7y ago
> State machine bug in Signal app Exploitable in the Android Signal app in particular; not the iOS one.
- zenexer 7y ago
  It’s potentially exploitable on iOS, but a UI issue has so far prevented the exploit from being useful. That’s not to say it couldn’t be exploited in a useful manner, and the vulnerability is still present. Continuing to use an unpatched version on iOS would be high-risk.
thinkbud 7y ago
Deja Vu. > you can send the callee the message the caller gets when the callee answers This is the exact same type of bug that was in libssh: https://www.nccgroup.trust/uk/our-research/technical-advisory-authentication-bypass-in-libssh/ https://www.nccgroup.trust/uk/our-research/technical-advisor... "possible to bypass authentication by presenting to the server an SSH2_MSG_USERAUTH_SUCCESS message in place of the SSH2_MSG_USERAUTH_REQUEST message which the server would expect to initiate authentication" Also, Apple had a FaceTime bug of very similar nature: https://www.theverge.com/2019/1/28/18201383/apple-facetime-bug-iphone-eavesdrop-listen-in-remote-call-security-issue https://www.theverge.com/2019/1/28/18201383/apple-facetime-b... "you begin calling somebody via FaceTime Video from within the Phone app. Before that person picks up, you can swipe up to add your own phone number to the call. Once you’ve added yourself, FaceTime immediately seems to assume it’s an active conference call and begins sending the audio of the person you’re calling"
- wolf550e 7y ago
  Yes, it's a classic bug, also reminds me of https://mitls.org/pages/attacks/SMACK#skip https://mitls.org/pages/attacks/SMACK#skip
- pushedx 7y ago
  And what’s the common theme here? Naive switch statement logic instead of a real state machine with fully mapped transitions.

loeg 7y ago

> State machine bug in Signal app Exploitable in the Android Signal app in particular; not the iOS one.

zenexer 7y ago
It’s potentially exploitable on iOS, but a UI issue has so far prevented the exploit from being useful. That’s not to say it couldn’t be exploited in a useful manner, and the vulnerability is still present. Continuing to use an unpatched version on iOS would be high-risk.

thinkbud 7y ago

Deja Vu. > you can send the callee the message the caller gets when the callee answers This is the exact same type of bug that was in libssh: https://www.nccgroup.trust/uk/our-research/technical-advisory-authentication-bypass-in-libssh/ https://www.nccgroup.trust/uk/our-research/technical-advisor... "possible to bypass authentication by presenting to the server an SSH2_MSG_USERAUTH_SUCCESS message in place of the SSH2_MSG_USERAUTH_REQUEST message which the server would expect to initiate authentication" Also, Apple had a FaceTime bug of very similar nature: https://www.theverge.com/2019/1/28/18201383/apple-facetime-bug-iphone-eavesdrop-listen-in-remote-call-security-issue https://www.theverge.com/2019/1/28/18201383/apple-facetime-b... "you begin calling somebody via FaceTime Video from within the Phone app. Before that person picks up, you can swipe up to add your own phone number to the call. Once you’ve added yourself, FaceTime immediately seems to assume it’s an active conference call and begins sending the audio of the person you’re calling"

wolf550e 7y ago
Yes, it's a classic bug, also reminds me of https://mitls.org/pages/attacks/SMACK#skip https://mitls.org/pages/attacks/SMACK#skip
pushedx 7y ago
And what’s the common theme here? Naive switch statement logic instead of a real state machine with fully mapped transitions.