Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WhatsApp Remote Code Execution in Video Call

nvd.nist.gov

Post reply on HN
Print view View original

21–30 of 159 posts

Re: WhatsApp Remote Code Execution in Video Call

#21

Post by gengear »

als0 wrote: post #11
DSingularity wrote: post #9

These applications should be treated as Trojan horses. If they aren’t open source and you are a journalist/dissident or anyone targeted by nation states you have got to assume your WhatsApp/Facebook is being used to compromise your device.

Even the App Store version of Signal is allegedly not the same as what's in the open source project. So unless you compile and install the applications yourself, there's no way of knowing anything.

even if you compile yourself you can't be sure. [Reflections on Trusting Trust ](https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_Ref...)

Re: WhatsApp Remote Code Execution in Video Call

#22

Post by 5d8767c68926 »

gengear wrote: post #21
als0 wrote: post #11

Earlier quoted context omitted.

Even the App Store version of Signal is allegedly not the same as what's in the open source project. So unless you compile and install the applications yourself, there's no way of knowing anything.

even if you compile yourself you can't be sure. [Reflections on Trusting Trust ]( https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_Ref... )

Has that attack ever been observed in the wild?

While I don't know if the current incarnations of Nix/Guix will succeed, I think we are slowly making progress towards reproducible builds everywhere.

Re: WhatsApp Remote Code Execution in Video Call

#23

Post by nixcraft »

Asdrubalini wrote: post #17
nixcraft wrote: post #7

Off topic: Why does WhatsApp don't give the option to block all calls and texts by default? That way, I can only talk with folks I want. The signal app has that option. Random businesses can send you texts to promote their shity services (typically, your number is grabbed from data brokers or leaks). Of course, you can block and report such spam, but there is no DnD option right now. Alt url as nvd is under load: Cri…

Wanna talk about how the WhatsApp client on macOS (and probably also Windows) by default shows your webcam on screen if someone videocalls you? That way if you are sharing your screen and someone happens to call you, everyone will be able to suddenly see you without warnings. For me is such an enormous privacy violation that I removed the client (which is also a memory hog) and now use only the browser version.

>now use only the browser version.

That is a great idea. But can you delete the app from your phone once connected to the web browser?

Re: WhatsApp Remote Code Execution in Video Call

#24

Post by michaelmior »

nixcraft wrote: post #23
Asdrubalini wrote: post #17

Earlier quoted context omitted.

Wanna talk about how the WhatsApp client on macOS (and probably also Windows) by default shows your webcam on screen if someone videocalls you? That way if you are sharing your screen and someone happens to call you, everyone will be able to suddenly see you without warnings. For me is such an enormous privacy violation that I removed the client (which is also a memory hog) and now use only the browser version.

>now use only the browser version. That is a great idea. But can you delete the app from your phone once connected to the web browser?

I believe so. Although you may need to periodically reinstall to reauth.

Re: WhatsApp Remote Code Execution in Video Call

#25

Post by Asdrubalini »

nixcraft wrote: post #23
Asdrubalini wrote: post #17

Earlier quoted context omitted.

Wanna talk about how the WhatsApp client on macOS (and probably also Windows) by default shows your webcam on screen if someone videocalls you? That way if you are sharing your screen and someone happens to call you, everyone will be able to suddenly see you without warnings. For me is such an enormous privacy violation that I removed the client (which is also a memory hog) and now use only the browser version.

>now use only the browser version. That is a great idea. But can you delete the app from your phone once connected to the web browser?

Definitely not, but I was referring to the macOS version. AFAIK you always need to have the app installed on some phone that is connected to the internet but things may have changed since I last checked. It doesn't bother me much on phone since i have never shared the screen but on computers is a real concern.

Re: WhatsApp Remote Code Execution in Video Call

#26

Post by nonasktell »

lucakiebel wrote: post #19
als0 wrote: post #11

Earlier quoted context omitted.

Even the App Store version of Signal is allegedly not the same as what's in the open source project. So unless you compile and install the applications yourself, there's no way of knowing anything.

So Apple has their Xcode Build service, why not add a badge to verify that an app was built from a linked public Github/Gitlab Repo

if you can't trust Meta, why could you trust apple?

Re: WhatsApp Remote Code Execution in Video Call

#27

Post by nonasktell »

consumer451 wrote: post #20
als0 wrote: post #11

Earlier quoted context omitted.

Even the App Store version of Signal is allegedly not the same as what's in the open source project. So unless you compile and install the applications yourself, there's no way of knowing anything.

That's interesting. Do you have any links for more info?

Before any backdooring purposes there is probably some marketing/analytics reasons, keys, OTF updates etc...

Re: WhatsApp Remote Code Execution in Video Call

#28

Post by UncleMeat »

mgraczyk wrote: post #13

Since the issue was in both the iOS and Android versions of the app, and it was caused by an integer overflow, does that mean that the bug was in a bundled C++ library implementing webRTC? Is there any information about the source-level cause of the issue?

It seems this way. "RCE via crafted media file" generally points to various media codecs and other processing that is implemented in native.

Re: WhatsApp Remote Code Execution in Video Call

#29

Post by beefield »

michaelmior wrote: post #24
nixcraft wrote: post #23

Earlier quoted context omitted.

>now use only the browser version. That is a great idea. But can you delete the app from your phone once connected to the web browser?

I believe so. Although you may need to periodically reinstall to reauth.

Install Whatsapp on a virtual android on your computer?

Re: WhatsApp Remote Code Execution in Video Call

#30

Post by UncleMeat »

DSingularity wrote: post #9

These applications should be treated as Trojan horses. If they aren’t open source and you are a journalist/dissident or anyone targeted by nation states you have got to assume your WhatsApp/Facebook is being used to compromise your device.

Being open source doesn't actually save you from exploitable vulns related to integer arithmetic.
Post reply on HN