Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WhatsApp Remote Code Execution in Video Call

nvd.nist.gov

Post reply on HN
Print view View original

71–80 of 159 posts

Re: WhatsApp Remote Code Execution in Video Call

#71

Post by vladvasiliu »

anvic wrote: post #15
pedro_hab wrote: post #10

Earlier quoted context omitted.

yes, WhatsApp used to be great in this regard, you would not get any spam. Now it's starting to get worse and worse. I block SMS notifications since I only get spam there (I'm Brazilian, SMS is basically dead here)

>Now it's starting to get worse and worse. Wait until the EU-mandated intercompatibility kicks in.

Wouldn't that actually help? As another commenter said, some apps actually allow blocking random callers. So, presumably, such an app could be used instead of WhatsApp while still being able to contact people on that network. Kind of like in the '00s, when you could use pidgin or some other third-party app to avoid the annoyances of msn or yahoo messenger.

Re: WhatsApp Remote Code Execution in Video Call

#72

Post by staticassertion »

gunwithdots wrote: post #32

On this subject, I like to quote Pavel Durov, the founder of Telegram: "Since the creation of WhatsApp, there's hardly been a moment in which it was secure: every few months researchers uncover a new security issue in the app. I wrote about this in detail 2 years ago (read here if you missed it). Nothing has changed since then. It would be hard to believe that the technical team of WhatsApp is so consistently incompe…

Telegram has had an arguably worse history of issues.

Re: WhatsApp Remote Code Execution in Video Call

#73

Post by staticassertion »

orangepurple wrote: post #50
glintik wrote: post #48

Earlier quoted context omitted.

«The Russian government hates him too.» Telegram is one of few popular messengers that are NOT blocked/prohibited in Russia. So government and Durov have some agreement.

Russia’s main security agency, the FSB (a successor to the KGB) has branded Telegram the messenger of choice for “international terrorist organizations in Russia.” The government’s first attempts to ban it, a year ago, resulted in entire sections of the web, online stores, services—even the Kremlin museum’s ticket sales—being inadvertently blocked. But the messaging app has adopted a clever system of changing IP addr…

> Russia’s main security agency, the FSB (a successor to the KGB) has branded Telegram the messenger of choice for “international terrorist organizations in Russia.”

You ever hear of ANoM?

Re: WhatsApp Remote Code Execution in Video Call

#74

Post by comboy »

godelski wrote: post #59
orangepurple wrote: post #45

Earlier quoted context omitted.

Quoted post unavailable.

> Wouldn't be shocked at all if Moxie is part of the Mossad. Hacker News is not the place to spread conspiracy theories. If you have compelling evidence, link it. If not, keep it to yourself. > Signal is suffocated by Moxie's tyranny. Good news, Moxie hasn't been with Signal for at least 9 months.

Hey, I'd love to hear that one. Moxie has been around for a long time. If somebody has rationalizations for everything he released broken and talked about in context of being part of Mossad that should be a fun read.

Re: WhatsApp Remote Code Execution in Video Call

#75

Post by anthk »

marcodiego wrote: post #61
5d8767c68926 wrote: post #22

Earlier quoted context omitted.

Has that attack ever been observed in the wild? While I don't know if the current incarnations of Nix/Guix will succeed, I think we are slowly making progress towards reproducible builds everywhere.

> Has that attack ever been observed in the wild? Yes: https://www.quora.com/What-is-a-coders-worst-nightmare/answe... Also, I remember in the 90's, people talking about a virus that infect pascal source code files. Memory is spotty about it. > While I don't know if the current incarnations of Nix/Guix will succeed, I think we are slowly making progress towards reproducible builds everywhere. Fortunately, the answer…

Not with Guix and Mes.

Re: WhatsApp Remote Code Execution in Video Call

#76

Post by neongreen »

AaronFriel wrote: post #40
gunwithdots wrote: post #32

On this subject, I like to quote Pavel Durov, the founder of Telegram: "Since the creation of WhatsApp, there's hardly been a moment in which it was secure: every few months researchers uncover a new security issue in the app. I wrote about this in detail 2 years ago (read here if you missed it). Nothing has changed since then. It would be hard to believe that the technical team of WhatsApp is so consistently incompe…

I wonder if someone more informed could help me understand Telegram's business model, as I don't think I could rightly describe the startup and product in a way that wouldn't sound like I was casting aspersions. Why would anyone use Telegram over something end to end encrypted, like Signal, Matrix, WhatsApp, Facebook Messenger, etc.?

I’ve tried all of the apps you listed and they all have significantly less polished UX, except perhaps for Messenger. In an alternative universe, I could very well be using Messenger.

My personal assessment is that if you have to communicate something that must not ever leak out, you shouldn’t use a chat app at all, period — because in many many cases my interlocutor is less careful than I am (or their degree of carefulness is unknown). You can use an E2E video app but not a chat app. Telegram’s video is E2E.

If my entire Telegram history leaks out, I estimate that I’ll be in a bit of trouble, but not significant trouble.

Of course, I might be wrong. In fact, while writing this comment I realized that the risk is probably somewhat bigger than I think it is, and in an ideal world using E2E would be advisable.

However, this isn’t “why you should use Telegram” but rather “why do you use Telegram”, so this is why I use it — significantly better UX, partly network effect, and partly that leaking my entire history is not even in the top 100 worries I have in life.

Re: WhatsApp Remote Code Execution in Video Call

#77

Post by upofadown »

DSingularity wrote: post #9

These applications should be treated as Trojan horses. If they aren’t open source and you are a journalist/dissident or anyone targeted by nation states you have got to assume your WhatsApp/Facebook is being used to compromise your device.

There was an interesting case where a bunch of Android messenger things got a WebRTC based remote code execution[1]. Signal got dinged to the extent that an attacker could trigger it with no action on the user's part.

The root problem here is that users want lots of features. Each added feature, particularly super complex ones like video, takes away from security. There is not point in spending a lot of time on your own code if you are going to end up invoking a whole lot of code that you can't control.

[1] https://googleprojectzero.blogspot.com/2020/08/exploiting-an...

Re: WhatsApp Remote Code Execution in Video Call

#78

Post by xvector »

kingnothing wrote: post #31
nonasktell wrote: post #26

Earlier quoted context omitted.

if you can't trust Meta, why could you trust apple?

Apple has been building their brand on privacy and trust for at least a couple of years now. Can you be sure they're not sending everything to the NSA? Of course not. But they also make their money by directly charging users for services unlike the ad-based companies. There have also been many attempts by various governments to publicly force Apple to insert backdoors or prevent them from fixing security vulnerabilit…

Apple's privacy is a marketing farce. They run data centers in China that provide full access to the government. Their anti-ad campaign was simply a push to gain dominance in the space themselves. They make a big fuss about end-to-end encryption but don't even bother to end to end encrypt your photos and backups!

I actually worked at Apple a few years ago in security. I was wondering why we didn't E2EE photos. The reason seemed to be - from what other engineers told me - is that it was at the behest of law enforcement. Lot easier to cooperate with LE and comply with NSLs when you can simply hand over the data they need.

Until Apple end-to-end encrypts these two things, it's all for naught. It doesn't fucking matter if your HomeKit data is E2EE if someone can take a look at your nudes without any cryptographic barrier.

Take that for what you will. Having worked at both companies during my career in a security capacity, I see no reason to trust one over the other wrt cloud services.

N.B. There are people at Apple that are very passionate about security and privacy. I was privileged to work with these people during my career. They really try to - and do - make a difference. My post is not an attack on them, but on the wider vision of the company, which is somewhat hypocritical.

Re: WhatsApp Remote Code Execution in Video Call

#79

Post by manquer »

Forbo wrote: post #69
alskdjflksjdf wrote: post #2

funny how all the whatsapp advisories since 2019 just move the same vulnerability around. Always an innocent stream processor missing a bounds check. Ooops.

I noticed the same thing with Cisco vulns a while back. How many times do you hard code credentials before it becomes an intentional backdoor rather than negligence?

It is more the corporate culture on how security is treated .

Sure it is might convenient for NSA who probably use it when it is found , but is less likely that company of cisco size can intentionally do something like that coordinated and keep it secret too.

Re: WhatsApp Remote Code Execution in Video Call

#80

Post by justapassenger »

pjmlp wrote: post #52
saddlerustle wrote: post #37

Earlier quoted context omitted.

Notably on iOS there's no good way to isolate unsafe native libraries from the rest of your app without violating app store policies, because Apple enforces apps to be single process and doesn't allow use of its own sandboxing apis.

When most code is Objective-C it hardly matters anyway.

You only need a bug in a single line of code of your dependency to compromise the whole app. Most of the code doesn’t matter for security.
Post reply on HN