Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WhatsApp Remote Code Execution in Video Call

nvd.nist.gov

Post reply on HN
Print view View original

31–40 of 159 posts

Re: WhatsApp Remote Code Execution in Video Call

#31

Post by kingnothing »

nonasktell wrote: post #26
lucakiebel wrote: post #19

Earlier quoted context omitted.

So Apple has their Xcode Build service, why not add a badge to verify that an app was built from a linked public Github/Gitlab Repo

if you can't trust Meta, why could you trust apple?

Apple has been building their brand on privacy and trust for at least a couple of years now. Can you be sure they're not sending everything to the NSA? Of course not. But they also make their money by directly charging users for services unlike the ad-based companies. There have also been many attempts by various governments to publicly force Apple to insert backdoors or prevent them from fixing security vulnerabilities which have failed.

Re: WhatsApp Remote Code Execution in Video Call

#32

Post by gunwithdots »

On this subject, I like to quote Pavel Durov, the founder of Telegram:

"Since the creation of WhatsApp, there's hardly been a moment in which it was secure: every few months researchers uncover a new security issue in the app. I wrote about this in detail 2 years ago (read here if you missed it). Nothing has changed since then.

It would be hard to believe that the technical team of WhatsApp is so consistently incompetent. Telegram, a far more sophisticated app, has never had security issues of such severity."

Re: WhatsApp Remote Code Execution in Video Call

#33

Post by neodypsis »

lucakiebel wrote: post #19
als0 wrote: post #11

Earlier quoted context omitted.

Even the App Store version of Signal is allegedly not the same as what's in the open source project. So unless you compile and install the applications yourself, there's no way of knowing anything.

So Apple has their Xcode Build service, why not add a badge to verify that an app was built from a linked public Github/Gitlab Repo

That'd be cool.

Re: WhatsApp Remote Code Execution in Video Call

#34

Post by whydoyoucare »

5d8767c68926 wrote: post #22
gengear wrote: post #21

Earlier quoted context omitted.

even if you compile yourself you can't be sure. [Reflections on Trusting Trust ]( https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_Ref... )

Has that attack ever been observed in the wild? While I don't know if the current incarnations of Nix/Guix will succeed, I think we are slowly making progress towards reproducible builds everywhere.

No one knows for sure, though compromised compilers are not far fetched - there has been an implicit trust on compiler toolchains. Reproducible builds are a few years out from full general adoption.

Re: WhatsApp Remote Code Execution in Video Call

#36

Post by mkmk3 »

gunwithdots wrote: post #32

On this subject, I like to quote Pavel Durov, the founder of Telegram: "Since the creation of WhatsApp, there's hardly been a moment in which it was secure: every few months researchers uncover a new security issue in the app. I wrote about this in detail 2 years ago (read here if you missed it). Nothing has changed since then. It would be hard to believe that the technical team of WhatsApp is so consistently incompe…

Coming from an app with a quarter of the users (so to say it's been less of a subject of investigation as such). "Far more sophisticated" also? What does that mean?

If Whatsapp has voluntarily been adding these issues, or has been targeted somehow, I would love to dig into research related to that. I'll check out the details regarding this attack in some hours.

This perspective seems extreme given the current evidence though. Switch to something like Matrix for sure though u.u

Edit: I'm not a proponent for whatsapp. I just understand telegram also isn't the best, and has a good incentive to shit on whatsapp

Re: WhatsApp Remote Code Execution in Video Call

#37

Post by saddlerustle »

mgraczyk wrote: post #13

Since the issue was in both the iOS and Android versions of the app, and it was caused by an integer overflow, does that mean that the bug was in a bundled C++ library implementing webRTC? Is there any information about the source-level cause of the issue?

Notably on iOS there's no good way to isolate unsafe native libraries from the rest of your app without violating app store policies, because Apple enforces apps to be single process and doesn't allow use of its own sandboxing apis.

Re: WhatsApp Remote Code Execution in Video Call

#38

Post by polyomino »

kingnothing wrote: post #31
nonasktell wrote: post #26

Earlier quoted context omitted.

if you can't trust Meta, why could you trust apple?

Apple has been building their brand on privacy and trust for at least a couple of years now. Can you be sure they're not sending everything to the NSA? Of course not. But they also make their money by directly charging users for services unlike the ad-based companies. There have also been many attempts by various governments to publicly force Apple to insert backdoors or prevent them from fixing security vulnerabilit…

> But they also make their money by directly charging users for services unlike the ad-based companies.

this does not make them more trustworthy

> There have also been many attempts by various governments to publicly force Apple to insert backdoors or prevent them from fixing security vulnerabilities which have failed.

Except in china, I suppose.

Re: WhatsApp Remote Code Execution in Video Call

#40

Post by AaronFriel »

gunwithdots wrote: post #32

On this subject, I like to quote Pavel Durov, the founder of Telegram: "Since the creation of WhatsApp, there's hardly been a moment in which it was secure: every few months researchers uncover a new security issue in the app. I wrote about this in detail 2 years ago (read here if you missed it). Nothing has changed since then. It would be hard to believe that the technical team of WhatsApp is so consistently incompe…

I wonder if someone more informed could help me understand Telegram's business model, as I don't think I could rightly describe the startup and product in a way that wouldn't sound like I was casting aspersions.

Why would anyone use Telegram over something end to end encrypted, like Signal, Matrix, WhatsApp, Facebook Messenger, etc.?

Post reply on HN