Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WhatsApp Remote Code Execution in Video Call

nvd.nist.gov

Post reply on HN
Print view View original

51–60 of 159 posts

Re: WhatsApp Remote Code Execution in Video Call

#51

Post by orangepurple »

saddlerustle wrote: post #43
gunwithdots wrote: post #32

On this subject, I like to quote Pavel Durov, the founder of Telegram: "Since the creation of WhatsApp, there's hardly been a moment in which it was secure: every few months researchers uncover a new security issue in the app. I wrote about this in detail 2 years ago (read here if you missed it). Nothing has changed since then. It would be hard to believe that the technical team of WhatsApp is so consistently incompe…

Telegram implements video calling using bunch of sketchy C code same as WhatsApp and Signal. There's no reason to think it's less vulnerable these sort of bugs.

"sketchy c code" is a tautology

Re: WhatsApp Remote Code Execution in Video Call

#52

Post by pjmlp »

saddlerustle wrote: post #37
mgraczyk wrote: post #13

Since the issue was in both the iOS and Android versions of the app, and it was caused by an integer overflow, does that mean that the bug was in a bundled C++ library implementing webRTC? Is there any information about the source-level cause of the issue?

Notably on iOS there's no good way to isolate unsafe native libraries from the rest of your app without violating app store policies, because Apple enforces apps to be single process and doesn't allow use of its own sandboxing apis.

When most code is Objective-C it hardly matters anyway.

Re: WhatsApp Remote Code Execution in Video Call

#53

Post by UncleMeat »

LtWorf wrote: post #46
UncleMeat wrote: post #30

Earlier quoted context omitted.

Being open source doesn't actually save you from exploitable vulns related to integer arithmetic.

It saves you from obviously planted ones that can be found by code scanners.

Is there any evidence that this overflow was easily found with straightforward static analysis?

Re: WhatsApp Remote Code Execution in Video Call

#54

Post by godelski »

consumer451 wrote: post #20
als0 wrote: post #11

Earlier quoted context omitted.

Even the App Store version of Signal is allegedly not the same as what's in the open source project. So unless you compile and install the applications yourself, there's no way of knowing anything.

That's interesting. Do you have any links for more info?

It's not a realistic danger and just fear mongering. I'm not sure why people on HN feel the need go after Signal so hard. I do think criticism is important (and Signal definitely deserves plenty) but these types of criticisms are off base and not specific to Signal, nor are they that relevant (kinda how people post on Signal's tweets about Iran complaining about lack of usernames. Not the time nor place).

It isn't meaningfully different from saying that Google/Apple can pretend to put the real App in the App Store but replace it with one that has a backdoor. This is entirely possible. But also the risk of this is extremely high and people do decompile apps like Signal, WhatsApp, and Telegram (albeit this can only go so far). These are all high profile and highly scrutinized apps. It is just fear mongering.

Re: WhatsApp Remote Code Execution in Video Call

#55

Post by marcodiego »

UncleMeat wrote: post #30
DSingularity wrote: post #9

These applications should be treated as Trojan horses. If they aren’t open source and you are a journalist/dissident or anyone targeted by nation states you have got to assume your WhatsApp/Facebook is being used to compromise your device.

Being open source doesn't actually save you from exploitable vulns related to integer arithmetic.

I enables independent, non-involved, non-interested parties to check it. Also when the protocol is open, it enables multiple implementations; keeping a known-by-few trojan style bug in all of them is specially difficult.

Re: WhatsApp Remote Code Execution in Video Call

#56

Post by marcodiego »

als0 wrote: post #11
DSingularity wrote: post #9

These applications should be treated as Trojan horses. If they aren’t open source and you are a journalist/dissident or anyone targeted by nation states you have got to assume your WhatsApp/Facebook is being used to compromise your device.

Even the App Store version of Signal is allegedly not the same as what's in the open source project. So unless you compile and install the applications yourself, there's no way of knowing anything.

That is why we must support initiatives like f-droid. They put a special focus on reproducibility.

Re: WhatsApp Remote Code Execution in Video Call

#57

Post by godelski »

mr_mitm wrote: post #44
AaronFriel wrote: post #40

Earlier quoted context omitted.

I wonder if someone more informed could help me understand Telegram's business model, as I don't think I could rightly describe the startup and product in a way that wouldn't sound like I was casting aspersions. Why would anyone use Telegram over something end to end encrypted, like Signal, Matrix, WhatsApp, Facebook Messenger, etc.?

It has features that regular users really, really like. Not having to associate the account with a phone number, scheduled messages, groups/channels with thousands of users, the ability to program bots, silent messages, editable messages, ... Some people care more about these than security or privacy. It's that simple. As for monetization, I believe they have premium stickers and such.

I think the irony is that so many attack Signal for pursuing more features. While they aren't features I personally care about I do recognize that I can't have secure communications with people that are unwilling to use secure means of messaging. While I want anonymous identities (not actually usernames akin to what we have here) I do think the social graph is far more important. Not that you can't work on both at the same time (though Telegram and WA have significantly more developers)

Re: WhatsApp Remote Code Execution in Video Call

#58

Post by marcodiego »

gengear wrote: post #21
als0 wrote: post #11

Earlier quoted context omitted.

Even the App Store version of Signal is allegedly not the same as what's in the open source project. So unless you compile and install the applications yourself, there's no way of knowing anything.

even if you compile yourself you can't be sure. [Reflections on Trusting Trust ]( https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_Ref... )

Reproducible builds make an attack like this as likely as "the whole world is a big conspiracy".

Re: WhatsApp Remote Code Execution in Video Call

#59

Post by godelski »

orangepurple wrote: post #45
AaronFriel wrote: post #40

Earlier quoted context omitted.

I wonder if someone more informed could help me understand Telegram's business model, as I don't think I could rightly describe the startup and product in a way that wouldn't sound like I was casting aspersions. Why would anyone use Telegram over something end to end encrypted, like Signal, Matrix, WhatsApp, Facebook Messenger, etc.?

Quoted post unavailable.

> Wouldn't be shocked at all if Moxie is part of the Mossad.

Hacker News is not the place to spread conspiracy theories. If you have compelling evidence, link it. If not, keep it to yourself.

> Signal is suffocated by Moxie's tyranny.

Good news, Moxie hasn't been with Signal for at least 9 months.

Re: WhatsApp Remote Code Execution in Video Call

#60

Post by llui85 »

nixcraft wrote: post #23
Asdrubalini wrote: post #17

Earlier quoted context omitted.

Wanna talk about how the WhatsApp client on macOS (and probably also Windows) by default shows your webcam on screen if someone videocalls you? That way if you are sharing your screen and someone happens to call you, everyone will be able to suddenly see you without warnings. For me is such an enormous privacy violation that I removed the client (which is also a memory hog) and now use only the browser version.

>now use only the browser version. That is a great idea. But can you delete the app from your phone once connected to the web browser?

The phone has to check in with WhatsApp every 2 weeks for any linked devices to keep working.

https://faq.whatsapp.com/579413796526134/

Post reply on HN