Out-of-bounds indexing is always fun. I'm interested in programming languages with mostly-watertight spatial memory safety, which can prevent many exploits at a minimal ergonomic/flexibility cost, compared to temporal memory safety which requires a borrow checker and endless compiler complexity (plus I find it easier to statically verify you don't use-after-free in the limited code interacting with resource lifetimes, than index out-of-bounds in the majority of business logic interacting with arrays).
WhatsApp Remote Code Execution in Video Call
101–110 of 159 posts
Re: WhatsApp Remote Code Execution in Video Call
#102funny how all the whatsapp advisories since 2019 just move the same vulnerability around. Always an innocent stream processor missing a bounds check. Ooops.
I noticed the same thing with Cisco vulns a while back. How many times do you hard code credentials before it becomes an intentional backdoor rather than negligence?
If you keep finding bedbugs in your house it doesn’t mean someone is intentionally putting them there. It just means that it’s really hard to get rid of all of them and more pop up naturally.
Re: WhatsApp Remote Code Execution in Video Call
#103Earlier quoted context omitted.
I noticed the same thing with Cisco vulns a while back. How many times do you hard code credentials before it becomes an intentional backdoor rather than negligence?
It is more the corporate culture on how security is treated . Sure it is might convenient for NSA who probably use it when it is found , but is less likely that company of cisco size can intentionally do something like that coordinated and keep it secret too.
Or perhaps the researchers are just looking for vulnerabilities similar to the last one found.
Re: WhatsApp Remote Code Execution in Video Call
#104On this subject, I like to quote Pavel Durov, the founder of Telegram: "Since the creation of WhatsApp, there's hardly been a moment in which it was secure: every few months researchers uncover a new security issue in the app. I wrote about this in detail 2 years ago (read here if you missed it). Nothing has changed since then. It would be hard to believe that the technical team of WhatsApp is so consistently incompe…
> It would be hard to believe that the technical team of WhatsApp is so consistently incompetent. Telegram, a far more sophisticated app, has never had security issues of such severity.
This says a lot more about the technical competence of Pavel Durov than it does of the WhatsApp team.
Re: WhatsApp Remote Code Execution in Video Call
#105Earlier quoted context omitted.
Notably on iOS there's no good way to isolate unsafe native libraries from the rest of your app without violating app store policies, because Apple enforces apps to be single process and doesn't allow use of its own sandboxing apis.
I believe you’re able to use XPC Services to achieve that no? Edit: actually no, XPC Services are Mac only so wouldn’t help on iOS. WASI would be the closest thing to a secure runtime
[dead]
Re: WhatsApp Remote Code Execution in Video Call
#106Earlier quoted context omitted.
Has that attack ever been observed in the wild? While I don't know if the current incarnations of Nix/Guix will succeed, I think we are slowly making progress towards reproducible builds everywhere.
No one knows for sure, though compromised compilers are not far fetched - there has been an implicit trust on compiler toolchains. Reproducible builds are a few years out from full general adoption.
Assembly code can be read to see if it matches.
Re: WhatsApp Remote Code Execution in Video Call
#107Earlier quoted context omitted.
I noticed the same thing with Cisco vulns a while back. How many times do you hard code credentials before it becomes an intentional backdoor rather than negligence?
If you keep finding bedbugs in your house it doesn’t mean someone is intentionally putting them there. It just means that it’s really hard to get rid of all of them and more pop up naturally.
alternatively you just haven't found what keeps attracting these bed bugs, like easy prey.
Re: WhatsApp Remote Code Execution in Video Call
#108Earlier quoted context omitted.
Lots of people have attempted this sort of analysis. You can find attempts at this in ICSE of FSE or whatever. But frankly there is no way to make effective science out of this. All of the data are always messy and make huge compromises to get anything even close to resembling an apples-to-apples comparison. I don't believe that anybody who claims it is meaningfully better in open source has any actual data really ba…
Good insight about the long tail of open source projects that don't have the same level of activity or interest from the developer community. I hadn't considered how sharply that drop off is, even for some what still widely used projects simply because the amount of people with the know how, and interest, to look for vulnerabilities is a lot smaller than the available project surface area.
I'm not even sure that "long tail" is the right phrase for it. I'd say "virtually all." The number of open source projects that get meaningful external scrutiny from security researchers is in the tens. Tens.
There is some automation out there. It is largely worthless. Some stuff is real like "hey, you've got a private key committed over here" but pretty quickly you run into high false positive rate garbage when looking at automated systems.
Re: WhatsApp Remote Code Execution in Video Call
#109Earlier quoted context omitted.
I think that’s true of all software, people are fallible open source or not. I’d love to see average time to discovery and reporting in closed versus open source though. I’ve always heard it’s better in open source, which intuitively makes sense, and by the nature of closed source I think gathering the data will be challenging but valuable to see a tight comparison.
It's definitely a lot better in memory safe languages (and especially in those applications that don't depend on C libraries under the hood). You can still have security bugs due to logic errors, but you won't ever get remote code execution or ability to read arbitrary memory. And in general bugs are much more likely to cause a crash rather than give the attacker access. I suspect once C has been supplanted all the w…
It is true that memory-safe languages are a massive massive massive boon! I believe that the entire industry needs to be making plans to find a way to shift all applications that operate on untrusted data away from C and C++. But this is completely orthogonal to the purported security benefits of making your source available.
Re: WhatsApp Remote Code Execution in Video Call
#110What is the impact of this vulnerability? I don’t see what an attacker can do if they successfully exploited this. Since this is in a bundled library does it help me get past the iOS sandbox for example? If so can one steal WhatsApp keys? What is the fallout, does anyone know?