3 ms·
Would love more details about how Fb detected this. As usual, the article is light on those though.
by yellow_lead 7y ago
Would love more details about how Fb detected this. As usual, the article is light on those though.
- Scoundreller 7y agoMy guess is that WhatsApp is continuously doing scans of its binaries, memory and other states that should be constant, and phones home with those signatures. When the phone homes are unexpected, a lot more than the signatures start getting phoned home for further investigation. Add some other constraints on how big the binary/memory space can be in the sandbox and an attacker would have trouble running a shadow copy to provide the right responses. Maybe some timing checks too where the system denies anything that starts taking longer than it should and phones home with it. All just a thought though.
- londons_explore 7y agoWhatsApp keeps debug logs of a lot of things. The exploit NSO used required a video call, which requires Facebook's servers to initiate, so is probably logged. I would guess all those video calls had a few fields set differently compared to the official client, so it was easy to filter the logs and find all instances of it.