Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WhatsApp Remote Code Execution in Video Call

nvd.nist.gov

Post reply on HN
Print view View original

151–159 of 159 posts

Re: WhatsApp Remote Code Execution in Video Call

#151

Post by GoblinSlayer »

marcodiego wrote: post #55
UncleMeat wrote: post #30

Earlier quoted context omitted.

Being open source doesn't actually save you from exploitable vulns related to integer arithmetic.

I enables independent, non-involved, non-interested parties to check it. Also when the protocol is open, it enables multiple implementations; keeping a known-by-few trojan style bug in all of them is specially difficult.

>Also when the protocol is open, it enables multiple implementations

Nice theory, but most of the time it's "just use zlib, bro, it's battle tested".

Re: WhatsApp Remote Code Execution in Video Call

#152

Post by el_nahual »

yjftsjthsd-h wrote: post #114
el_nahual wrote: post #92

Earlier quoted context omitted.

I am one of these "WhatsApp spammers" (well, I don't consider myself a spammer but you might!). We sell financial services in a developing country. We're not a mobile app—we're just a mobile-first website (a common gripe on HN is 'there's too many apps, just make a website'. Well, we're one of them). We need to be able to get in touch with our customers for transactional purposes (changes to their account, delivery n…

Why would any of that require you to send unsolicited messages? If the user wants notifications, they can add you to their contacts

I think unsolicited was the wrong word. "Transactional messages that are not a reply" is better (like a login shortcode, or a 'payment processed' message)

Re: WhatsApp Remote Code Execution in Video Call

#153

Post by el_nahual »

benplumley wrote: post #137
el_nahual wrote: post #92

Earlier quoted context omitted.

I am one of these "WhatsApp spammers" (well, I don't consider myself a spammer but you might!). We sell financial services in a developing country. We're not a mobile app—we're just a mobile-first website (a common gripe on HN is 'there's too many apps, just make a website'. Well, we're one of them). We need to be able to get in touch with our customers for transactional purposes (changes to their account, delivery n…

> Which would you prefer? The native app, no question. Why would I want to make a facebook account just to get notifications from a third party (you)?

You don't need a facebook account to use WhatsApp, and where we are WA penetration is already over 97%.

Re: WhatsApp Remote Code Execution in Video Call

#154

Post by Forbo »

2Gkashmiri wrote: post #126
Forbo wrote: post #97

Earlier quoted context omitted.

It's going to take nothing short of massive legal action to get any sort of competitive compatibility like that. As much as I wish for that to happen my hopes aren't very high. So until then I'll keep chugging along on whatever open solutions I can, hoping that my small contribution to network effects will help steer things down the line.

https://element.io/blog/the-digital-markets-act-explained-in... think again

Somehow this is the first I've heard of the Digital Markets Act. That's awesome, glad to hear something is happening around this!

Re: WhatsApp Remote Code Execution in Video Call

#155

Post by hulitu »

marcodiego wrote: post #121
lmm wrote: post #112

Earlier quoted context omitted.

If this particular exploit had been deliberately inserted by WhatsApp developers, what would you expect to be different?

They are the only party who have access to the code. They don't even need to pretend about unintentional bugs. The world had a lesson with PRISM, if we learned anything... that is a different matter.

They didn't learned anything. The mantra is "i would not happen to me".

Re: WhatsApp Remote Code Execution in Video Call

#156

Post by yjftsjthsd-h »

el_nahual wrote: post #152
yjftsjthsd-h wrote: post #114

Earlier quoted context omitted.

Why would any of that require you to send unsolicited messages? If the user wants notifications, they can add you to their contacts

I think unsolicited was the wrong word. "Transactional messages that are not a reply" is better (like a login shortcode, or a 'payment processed' message)

Okay, but that should work fine in a model where users have to opt in to receiving messages?

Re: WhatsApp Remote Code Execution in Video Call

#158

Post by jhoelzel »

alskdjflksjdf wrote: post #2

funny how all the whatsapp advisories since 2019 just move the same vulnerability around. Always an innocent stream processor missing a bounds check. Ooops.

Whaaaat? In the defacto messaging app of the world? Noooo way.

I mean its the same theory as letsencrypt sending your ssl cert to other sources after giving it to you for free.

Or the Weather app on every iphone being a nice direct way to track a phone location throughout the day.

PS: of course this is all wild speculation, but fun wild speculation ;)

Re: WhatsApp Remote Code Execution in Video Call

#159

Post by jhoelzel »

gauravphoenix wrote: post #84

What is the worst case scenario here? Will the adversary be able to break out of the sandbox? i.e. will the adversary be able to access non WhatsApp data?

I dont think they can break the sandbox. because then apple would have most likely removed them from the store already.

However what they can do is everything the app can do: - get your contacts - get your messages - get your photos - get your location - get the people you chat with - read the stati of your contacts

therefore i would assume with the right tools you can directly identify a phone use, its social circle, most talked topics on an "encrypted messenger" and since the messages are right there: sentiment analysis of conversations had and therefore social status of the pople you chat with

actually its quite terrifying. but so is the idea also that our faces and words are being handed through the world by a tech company without international regulations...... soooo business as usual =)

Post reply on HN