14 ms·
WhatsApp Remote Code Execution in Video Call
- alskdjflksjdf 4y agofunny how all the whatsapp advisories since 2019 just move the same vulnerability around. Always an innocent stream processor missing a bounds check. Ooops.
- Forbo 4y agoI noticed the same thing with Cisco vulns a while back. How many times do you hard code credentials before it becomes an intentional backdoor rather than negligence?
- manquer 4y agoIt is more the corporate culture on how security is treated . Sure it is might convenient for NSA who probably use it when it is found , but is less likely that company of cisco size can intentionally do something like that coordinated and keep it secret too.
- saagarjha 4y agoIf you keep finding bedbugs in your house it doesn’t mean someone is intentionally putting them there. It just means that it’s really hard to get rid of all of them and more pop up naturally.
- bobkazamakis 4y agoalternatively you just haven't found what keeps attracting these bed bugs, like easy prey.
- xmprt 4y agoThat still doesn't make the bed bugs intentional.
- LudwigNagasena 4y agoSure, but that’s two totally different situations with different contexts.
- fulafel 4y agoNegligence as a term implies liability. But there's mostly no liability in software for some reason.
- jhoelzel 4y agoWhaaaat? In the defacto messaging app of the world? Noooo way. I mean its the same theory as letsencrypt sending your ssl cert to other sources after giving it to you for free. Or the Weather app on every iphone being a nice direct way to track a phone location throughout the day. PS: of course this is all wild speculation, but fun wild speculation ;)
- deleted 4y ago[deleted]
- rafale 4y ago
- asdffasdf1234 4y agoah yes, jewish origins. very suspect.... /s
- bloqs 4y agoIsraeli / Jewish origins? For fucks sake.
- anvic 4y ago
- dang 4y agoWe ban accounts that post like this, so please don't. We detached this subthread from https://news.ycombinator.com/item?id=32996849 https://news.ycombinator.com/item?id=32996849. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- nixcraft 4y agoOff topic: Why does WhatsApp don't give the option to block all calls and texts by default? That way, I can only talk with folks I want. The signal app has that option. Random businesses can send you texts to promote their shity services (typically, your number is grabbed from data brokers or leaks). Of course, you can block and report such spam, but there is no DnD option right now. Alt url as nvd is under load: Critical WhatsApp vulnerabilities patched https://www.malwarebytes.com/blog/news/2022/09/critical-whatsapp-vulnerabilities-patched-check-youve-updated https://www.malwarebytes.com/blog/news/2022/09/critical-what... Edit: I forgot to mention almost all spam is from verified whatapps business accounts. So I believe they/FB are selling data directly under their updated TOS.
- pedro_hab 4y agoyes, WhatsApp used to be great in this regard, you would not get any spam. Now it's starting to get worse and worse. I block SMS notifications since I only get spam there (I'm Brazilian, SMS is basically dead here)
- anvic 4y ago>Now it's starting to get worse and worse. Wait until the EU-mandated intercompatibility kicks in.
- vladvasiliu 4y agoWouldn't that actually help? As another commenter said, some apps actually allow blocking random callers. So, presumably, such an app could be used instead of WhatsApp while still being able to contact people on that network. Kind of like in the '00s, when you could use pidgin or some other third-party app to avoid the annoyances of msn or yahoo messenger.
- Asdrubalini 4y agoWanna talk about how the WhatsApp client on macOS (and probably also Windows) by default shows your webcam on screen if someone videocalls you? That way if you are sharing your screen and someone happens to call you, everyone will be able to suddenly see you without warnings. For me is such an enormous privacy violation that I removed the client (which is also a memory hog) and now use only the browser version.
- deleted 4y ago[deleted]
- DSingularity 4y agoThese applications should be treated as Trojan horses. If they aren’t open source and you are a journalist/dissident or anyone targeted by nation states you have got to assume your WhatsApp/Facebook is being used to compromise your device.
- als0 4y agoEven the App Store version of Signal is allegedly not the same as what's in the open source project. So unless you compile and install the applications yourself, there's no way of knowing anything.
- lucakiebel 4y agoSo Apple has their Xcode Build service, why not add a badge to verify that an app was built from a linked public Github/Gitlab Repo
- nonasktell 4y agoif you can't trust Meta, why could you trust apple?
- kingnothing 4y agoApple has been building their brand on privacy and trust for at least a couple of years now. Can you be sure they're not sending everything to the NSA? Of course not. But they also make their money by directly charging users for services unlike the ad-based companies. There have also been many attempts by various governments to publicly force Apple to insert backdoors or prevent them from fixing security vulnerabilities which have failed.
- polyomino 4y ago> But they also make their money by directly charging users for services unlike the ad-based companies. this does not make them more trustworthy > There have also been many attempts by various governments to publicly force Apple to insert backdoors or prevent them from fixing security vulnerabilities which have failed. Except in china, I suppose.
- ipython 4y agoThis publicly disclosed vuln brings a new perspective into the Bezos phone hacking incident: https://en.m.wikipedia.org/wiki/Jeff_Bezos_phone_hacking_incident https://en.m.wikipedia.org/wiki/Jeff_Bezos_phone_hacking_inc...
- ipython 4y agoEspecially since a related cve refers to vulnerable video file parsing: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-27492 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2749...
- MuffinFlavored 4y agoDoes this mean Jeff Bezos was doing WhatsApp video calls with https://en.wikipedia.org/wiki/Mohammed_bin_Salman https://en.wikipedia.org/wiki/Mohammed_bin_Salman ?
- oittaa 4y agoAll the articles at the time just mentioned that it was a video file. For example https://www.theguardian.com/technology/2020/jan/21/amazon-boss-jeff-bezoss-phone-hacked-by-saudi-crown-prince https://www.theguardian.com/technology/2020/jan/21/amazon-bo... Both Apple and Google have tried to isolate media codecs more since, but apparently not enough.
- mgraczyk 4y agoSince the issue was in both the iOS and Android versions of the app, and it was caused by an integer overflow, does that mean that the bug was in a bundled C++ library implementing webRTC? Is there any information about the source-level cause of the issue?
- UncleMeat 4y agoIt seems this way. "RCE via crafted media file" generally points to various media codecs and other processing that is implemented in native.
- saddlerustle 4y agoNotably on iOS there's no good way to isolate unsafe native libraries from the rest of your app without violating app store policies, because Apple enforces apps to be single process and doesn't allow use of its own sandboxing apis.
- black_puppydog 4y agoYou have to understand, they enforce those rules for security reasons. /s
- pjmlp 4y agoWhen most code is Objective-C it hardly matters anyway.
- justapassenger 4y agoYou only need a bug in a single line of code of your dependency to compromise the whole app. Most of the code doesn’t matter for security.
- pjmlp 4y agoThe usual argument that safer languages are needless, because bugs happen anyway, yet Apple is going Swift, and adopting hardware mitigations to fix these kind of issues.
- deleted 4y ago[deleted]
- 2Gkashmiri 4y agowaiting for the time when i can only use my matrix/element and be able to talk to whatsapp or instagram or snapchat users without creating and maintaining accounts there.
- Forbo 4y agoIt's going to take nothing short of massive legal action to get any sort of competitive compatibility like that. As much as I wish for that to happen my hopes aren't very high. So until then I'll keep chugging along on whatever open solutions I can, hoping that my small contribution to network effects will help steer things down the line.
- 2Gkashmiri 4y agohttps://element.io/blog/the-digital-markets-act-explained-in-15-questions/ https://element.io/blog/the-digital-markets-act-explained-in... think again
- Forbo 4y agoSomehow this is the first I've heard of the Digital Markets Act. That's awesome, glad to hear something is happening around this!
- gunwithdots 4y agoOn this subject, I like to quote Pavel Durov, the founder of Telegram: "Since the creation of WhatsApp, there's hardly been a moment in which it was secure: every few months researchers uncover a new security issue in the app. I wrote about this in detail 2 years ago (read here if you missed it). Nothing has changed since then. It would be hard to believe that the technical team of WhatsApp is so consistently incompetent. Telegram, a far more sophisticated app, has never had security issues of such severity."
- mkmk3 4y agoComing from an app with a quarter of the users (so to say it's been less of a subject of investigation as such). "Far more sophisticated" also? What does that mean? If Whatsapp has voluntarily been adding these issues, or has been targeted somehow, I would love to dig into research related to that. I'll check out the details regarding this attack in some hours. This perspective seems extreme given the current evidence though. Switch to something like Matrix for sure though u.u Edit: I'm not a proponent for whatsapp. I just understand telegram also isn't the best, and has a good incentive to shit on whatsapp
- AaronFriel 4y agoI wonder if someone more informed could help me understand Telegram's business model, as I don't think I could rightly describe the startup and product in a way that wouldn't sound like I was casting aspersions. Why would anyone use Telegram over something end to end encrypted, like Signal, Matrix, WhatsApp, Facebook Messenger, etc.?
- mr_mitm 4y agoIt has features that regular users really, really like. Not having to associate the account with a phone number, scheduled messages, groups/channels with thousands of users, the ability to program bots, silent messages, editable messages, ... Some people care more about these than security or privacy. It's that simple. As for monetization, I believe they have premium stickers and such.
- 4y ago
- gauravphoenix 4y agoWhat is the worst case scenario here? Will the adversary be able to break out of the sandbox? i.e. will the adversary be able to access non WhatsApp data?
- londons_explore 4y agoSince this advisory is cross platform, I expect it just lets you execute code in the application context. Ie. You can still steal someone's entire conversation history.
- hn_throwaway_99 4y agoGive photo access to WhatsApp? Better hope there's not a dick pic in there or you end up like Bezos.
- system2 4y agoHe probably was lowkey proud to show his pp to the world. That man is a sociopath.
- jhoelzel 4y agoI dont think they can break the sandbox. because then apple would have most likely removed them from the store already. However what they can do is everything the app can do: - get your contacts - get your messages - get your photos - get your location - get the people you chat with - read the stati of your contacts therefore i would assume with the right tools you can directly identify a phone use, its social circle, most talked topics on an "encrypted messenger" and since the messages are right there: sentiment analysis of conversations had and therefore social status of the pople you chat with actually its quite terrifying. but so is the idea also that our faces and words are being handed through the world by a tech company without international regulations...... soooo business as usual =)
- hulitu 4y agoSo where the description of the vulnerability ? The OP links to whatsapp site which i cannot use because of the cookie banner.
- qopl 4y agoHere are the security advisories from WhatsApp: https://www.whatsapp.com/security/advisories/2022/ https://www.whatsapp.com/security/advisories/2022/ They're rather scant on detail. Anyone know if this was exploited in the wild? Or who discovered it otherwise? I'm also wondering if it was disclosed as part of an equities process, given the target and the type of bug.
- nyanpasu64 4y agoOut-of-bounds indexing is always fun. I'm interested in programming languages with mostly-watertight spatial memory safety, which can prevent many exploits at a minimal ergonomic/flexibility cost, compared to temporal memory safety which requires a borrow checker and endless compiler complexity (plus I find it easier to statically verify you don't use-after-free in the limited code interacting with resource lifetimes, than index out-of-bounds in the majority of business logic interacting with arrays).
- staticassertion 4y agoGoogle just published that 50% of exploited vulnerabilities in Chrome are Use After Free, so I'm very bearish on the "temporal safety will be enough" thing being pushed. Temporal safety does not require a borrow checker etc, you can use a GC and get it.
- selfmodruntime 4y agoAny language can implement safe vector / array accessing with a `get` call returning either a sum type of throwing an exception when the element does not exist at the index. Quite frankly, manually indexing into an array should be entirely avoided if possible, even more so with safety critical software.
- GoblinSlayer 4y agoIt's easier to name languages without ergonomic bound checks: Assembler and C. They were done in STL for ages, but only in debug mode, which makes them useless, but it's not a technical problem.
- yalogin 4y agoWhat is the impact of this vulnerability? I don’t see what an attacker can do if they successfully exploited this. Since this is in a bundled library does it help me get past the iOS sandbox for example? If so can one steal WhatsApp keys? What is the fallout, does anyone know?
- flatiron 4y agoIt runs as whatsapp so if you allowed it access to photos, location, etc you gain that. Very powerful stuff.
- GoblinSlayer 4y agoAnd message history.
- perryizgr8 4y ago> An integer overflow in WhatsApp for... iOS prior to v2.22.16.12, Business for iOS prior to v2.22.16.12 could result in remote code execution in an established video call. Huh, I guess you can finally run your own software on your iPhone. Whatsapp FTW.