FT.com worst site in the world.. I thought you can't link things that require a subscription to read?
WhatsApp voice calls were used to inject spyware on phones
251–260 of 313 posts
Re: WhatsApp voice calls were used to inject spyware on phones
#252I like it how Facebook doesn't mention anything in the WhatsApp changelog about this.
Apple won't let you change a changelog after the binary is built and put on the store. So if you want to get a fix out, but not alert people that you're on to them, you have to put out a changelog that just says something like "Bugfixes". Then you have to build another build and submit another changelog, but Apple probably won't let you issue builds that are duplicates...
Re: WhatsApp voice calls were used to inject spyware on phones
#253CVE-2019-3568 suggests this was a buffer overflow. I'd like to understand why this was implemented in native code - Android seems to have an `android.net.rtp` package? Is this simply for performance, or to enable code-sharing across Android and iOS? Is there anything about WhatsApp's use-case that would prevent an implementation using managed code?
Also, what exploitation mitigations are broken on Android/iOS such that a buffer overflow is reliably exploitable? Are their implementations of ASLR useless? Is it trivially bypassed? Is mandatory code-signing not enabled/enforced?
Re: WhatsApp voice calls were used to inject spyware on phones
#254Earlier quoted context omitted.
Gaining control of WhatsApp gains access to any API accessible to WhatsApp. Incompetent reporting may be at fault. On Android, WhatsApp seeks a wide array of permission-controlled APIs. It does so on iOS as well. Once granted, the app has access to any data available through access-allowed APIs. App code goes through an audit process to ensure that the app isn’t using accessible APIs inappropriately, and doesn’t perm…
There should be different permissions for foreground and background access to APIs.
Or there should simply not be background access to certain APIs, such as camera, video, and photo library.
Background audio access on iOS presents a bright red indicator on all non-app screens that can neither be hidden nor removed, as it’s baked into the OS. iOS may require a separate permission dialog for “capture video with sound” and “record sound with/out screen on”, I don’t know. I doubt Android bothers to do any of this.
Re: WhatsApp voice calls were used to inject spyware on phones
#255Earlier quoted context omitted.
Gaining control of WhatsApp gains access to any API accessible to WhatsApp. Incompetent reporting may be at fault. On Android, WhatsApp seeks a wide array of permission-controlled APIs. It does so on iOS as well. Once granted, the app has access to any data available through access-allowed APIs. App code goes through an audit process to ensure that the app isn’t using accessible APIs inappropriately, and doesn’t perm…
Do you happen to know if upgrading the app would remove persistence (inside the app)?
Without knowing how they infect the app? No, I cannot know.
Re: WhatsApp voice calls were used to inject spyware on phones
#256CVE-2019-3568 suggests this was a buffer overflow. I'd like to understand why this was implemented in native code - Android seems to have an `android.net.rtp` package? Is this simply for performance, or to enable code-sharing across Android and iOS? Is there anything about WhatsApp's use-case that would prevent an implementation using managed code?
Is Android.net.rtp available on every support Android and Google Library version combination that WhatsApp natively supports?
Re: WhatsApp voice calls were used to inject spyware on phones
#257How were they able to install spyware on iOS devices?
No one has confirmed whether they were able to install anything beyond the confines of the app on iOS. The press are not particularly qualified to evaluate that consideration and have been doing a poor job of blurring what’s unlikely/impossible on iOS with what’s likely/possible on Android.
Re: WhatsApp voice calls were used to inject spyware on phones
#258Isn’t this also a screw up by Apple? Isn’t Sandboxing supposed to prevent this from getting any worse than hacking the app itself?
Isn’t every article about this saying it persists, without saying how or whether it’s a sandbox escape? If it just spins up bad code in WhatsApp space, that’s sufficient to spy on you.
Re: WhatsApp voice calls were used to inject spyware on phones
#259Earlier quoted context omitted.
Very interested to know what this means in practice, particularly for iOS. AFAIK, there's no permissions which allow you to read SMS messages, take screenshots (unless jailbroken), access photos in the background, access the camera in the background etc etc Does this just spy on the users Whatsapp activity, or spy on the user in a broader way? How could the API's whatsapp does have access to be abused?
> How could the APIs .. be abused? The app is infected, calls a 0-day using an illegal parameter that’s normally rejected by app store filters, and gains a permanent beachhead in your Android system services list. > access photos in the background Unclear. Apps can show thumbnail galleries of your photos within their native UI, so it may well be possible for them to continue directly to reading photos. > access the c…
Well I was thinking specifically about iOS :)
There's no possible way to read SMS messages programatically in iOS for example, the closest you get is reading one time passwords sent, and you can only do that when the user has the keyboard open when the SMS is received.
I know Android is slightly more lax in this (and some other) regards. I wonder if Android whatsapp users targeted by this exploit have had more data exposed than iOS users targeted by the same exploit?
Re: WhatsApp voice calls were used to inject spyware on phones
#260Can anyone advise on minimum version numbers containing the patch (on IOS and Android)?