WhatsApp Remote Code Execution in Video Call

Post by yazzku » Tue, Sep 27, 2022, 8:38 PM UTC

AaronFriel wrote: post #40

gunwithdots wrote: post #32

On this subject, I like to quote Pavel Durov, the founder of Telegram: "Since the creation of WhatsApp, there's hardly been a moment in which it was secure: every few months researchers uncover a new security issue in the app. I wrote about this in detail 2 years ago (read here if you missed it). Nothing has changed since then. It would be hard to believe that the technical team of WhatsApp is so consistently incompe…

I wonder if someone more informed could help me understand Telegram's business model, as I don't think I could rightly describe the startup and product in a way that wouldn't sound like I was casting aspersions. Why would anyone use Telegram over something end to end encrypted, like Signal, Matrix, WhatsApp, Facebook Messenger, etc.?

Post by ianbutler » Tue, Sep 27, 2022, 8:44 PM UTC

UncleMeat wrote: post #63

marcodiego wrote: post #55

Earlier quoted context omitted.

I enables independent, non-involved, non-interested parties to check it. Also when the protocol is open, it enables multiple implementations; keeping a known-by-few trojan style bug in all of them is specially difficult.

That's true. And yet, the linux kernel consistently has bugs like these in it. If you want exploitable vulns in literal media codecs go have fun taking a look at the history of ffmpeg. I love open source. In so many ways it is uniquely responsible for the development of our technology landscape. It is observably not a meaningfully different path to secure code than closed source development.

Post by pjmlp » Tue, Sep 27, 2022, 8:49 PM UTC

justapassenger wrote: post #80

pjmlp wrote: post #52

Earlier quoted context omitted.

When most code is Objective-C it hardly matters anyway.

You only need a bug in a single line of code of your dependency to compromise the whole app. Most of the code doesn’t matter for security.

Post by hulitu » Tue, Sep 27, 2022, 8:55 PM UTC

Post by londons_explore » Tue, Sep 27, 2022, 9:00 PM UTC

saddlerustle wrote: post #37

mgraczyk wrote: post #13

Since the issue was in both the iOS and Android versions of the app, and it was caused by an integer overflow, does that mean that the bug was in a bundled C++ library implementing webRTC? Is there any information about the source-level cause of the issue?

Notably on iOS there's no good way to isolate unsafe native libraries from the rest of your app without violating app store policies, because Apple enforces apps to be single process and doesn't allow use of its own sandboxing apis.