5 ms·

I'm glad it's fixed now. https://www.facebook.com/security/advisories/cve-2019-11931 https://www.facebook.com/security/advisories/cve-2019-11931

by henryw 7y ago

danso 7y ago
At the time, FB said it didn't believe the bug had been exploited: In this instance there is no reason to believe users were impacted. [0] The alleged hack of Bezos happened in May 2018, about 18 months after the Nov 2019 bug fix. I wonder if FB's statement was just boilerplate PR or if they really did substantial forensics to have "no reason to believe users were impacted". [0] https://nakedsecurity.sophos.com/2019/11/20/update-whatsapp-now-mp4-video-bug-exposes-your-messages/ https://nakedsecurity.sophos.com/2019/11/20/update-whatsapp-...
- penagwin 7y ago
  Anecdotal, but a lot of times phrases similar to that are used because the real answer is "We don't have any way of knowing if users were actually impacted" and it's obviously far better for PR to phrase it that way.
  - BelleOfTheBall 7y ago
    It does sound better but here's the thing: this is Jeff Bezos. He's one of the most high-profile people on the planet. If his phone was hacked through WhatsApp, he clearly filed a complaint and told them what had happened. They just didn't manage to patch it for over a year and then stated they 'had no way of knowing' even though this clearly proves it happened.
- moralestapia 7y ago
  s/after/before/
- khc 7y ago
  do you mean 18 months before?
- Thorrez 7y ago
  As I mentioned in my other comment, I see no reason to think that CVE-2019-11931 was exploited by NSO Group.
deleted 7y ago
[deleted]
therealdrag0 7y ago
This sort of thing blows my mind. Any rough theories on how this sort of thing can happen? How can an app go from parsing metadata to executing foreign code?
- rossjudson 7y ago
  It's called C. It's incredibly hard to write secure code in it.
  - earenndil 7y ago
    I thought whatsapp was erlang?
    - hooch 7y ago
      I don’t imagine there being much Erlang in the iOS and Android clients.
  - ghostpepper 7y ago
    Is there any C in WhatsApp?
    - londons_explore 7y ago
      Yes - all the media decoders are in C
      - ghostpepper 7y ago
        Cool, that actually does sound like a rather large attack surface for an innocent-looking attachment to wind up executing code
Thorrez 7y ago
Why do you think it was CVE-2019-11931? The Facebook vs. NSO lawsuit[1] mentions CVE-2019-3568[2]. CVE-2019-3568 was widely reported in May to have been exploited by NSO group[3]. [1] https://context-cdn.washingtonpost.com/notes/prod/default/documents/bf5edf35-5672-49fa-aca1-edefadff683f/note/8ef25c0d-fee9-416a-b7f9-e0a4dedc66f2.pdf https://context-cdn.washingtonpost.com/notes/prod/default/do... [2] https://www.facebook.com/security/advisories/cve-2019-3568 https://www.facebook.com/security/advisories/cve-2019-3568 [3] https://arstechnica.com/information-technology/2019/05/whatsapp-vulnerability-exploited-to-infect-phones-with-israeli-spyware/ https://arstechnica.com/information-technology/2019/05/whats...

I'm glad it's fixed now. https://www.facebook.com/security/advisories/cve-2019-11931 https://www.facebook.com/security/advisories/cve-2019-11931

by henryw 7y ago

I'm glad it's fixed now. https://www.facebook.com/security/advisories/cve-2019-11931 https://www.facebook.com/security/advisories/cve-2019-11931

danso 7y ago

At the time, FB said it didn't believe the bug had been exploited: In this instance there is no reason to believe users were impacted. [0] The alleged hack of Bezos happened in May 2018, about 18 months after the Nov 2019 bug fix. I wonder if FB's statement was just boilerplate PR or if they really did substantial forensics to have "no reason to believe users were impacted". [0] https://nakedsecurity.sophos.com/2019/11/20/update-whatsapp-now-mp4-video-bug-exposes-your-messages/ https://nakedsecurity.sophos.com/2019/11/20/update-whatsapp-...

penagwin 7y ago
Anecdotal, but a lot of times phrases similar to that are used because the real answer is "We don't have any way of knowing if users were actually impacted" and it's obviously far better for PR to phrase it that way.
- BelleOfTheBall 7y ago
  It does sound better but here's the thing: this is Jeff Bezos. He's one of the most high-profile people on the planet. If his phone was hacked through WhatsApp, he clearly filed a complaint and told them what had happened. They just didn't manage to patch it for over a year and then stated they 'had no way of knowing' even though this clearly proves it happened.
moralestapia 7y ago
s/after/before/
khc 7y ago
do you mean 18 months before?
Thorrez 7y ago
As I mentioned in my other comment, I see no reason to think that CVE-2019-11931 was exploited by NSO Group.

deleted 7y ago

[deleted]

therealdrag0 7y ago

This sort of thing blows my mind. Any rough theories on how this sort of thing can happen? How can an app go from parsing metadata to executing foreign code?

rossjudson 7y ago
It's called C. It's incredibly hard to write secure code in it.
- earenndil 7y ago
  I thought whatsapp was erlang?
  - hooch 7y ago
    I don’t imagine there being much Erlang in the iOS and Android clients.
- ghostpepper 7y ago
  Is there any C in WhatsApp?
  - londons_explore 7y ago
    Yes - all the media decoders are in C
    - ghostpepper 7y ago
      Cool, that actually does sound like a rather large attack surface for an innocent-looking attachment to wind up executing code

Thorrez 7y ago

Why do you think it was CVE-2019-11931? The Facebook vs. NSO lawsuit[1] mentions CVE-2019-3568[2]. CVE-2019-3568 was widely reported in May to have been exploited by NSO group[3]. [1] https://context-cdn.washingtonpost.com/notes/prod/default/documents/bf5edf35-5672-49fa-aca1-edefadff683f/note/8ef25c0d-fee9-416a-b7f9-e0a4dedc66f2.pdf https://context-cdn.washingtonpost.com/notes/prod/default/do... [2] https://www.facebook.com/security/advisories/cve-2019-3568 https://www.facebook.com/security/advisories/cve-2019-3568 [3] https://arstechnica.com/information-technology/2019/05/whatsapp-vulnerability-exploited-to-infect-phones-with-israeli-spyware/ https://arstechnica.com/information-technology/2019/05/whats...