Hacker News Reader

Comment by henryw | Hacker News Reader

I'm glad it's fixed now. https://www.facebook.com/security/advisories/cve-2019-11931

At the time, FB said it didn't believe the bug had been exploited: In this instance there is no reason to believe users were impacted. [0] The alleged hack of Bezos happened in May 2018, about 18 months after the Nov 2019 bug fix. I wonder if FB's statement was just boilerplate PR or if they really did substantial forensics to have "no reason to believe users were impacted".

[0] https://nakedsecurity.sophos.com/2019/11/20/update-whatsapp-...

Anecdotal, but a lot of times phrases similar to that are used because the real answer is "We don't have any way of knowing if users were actually impacted" and it's obviously far better for PR to phrase it that way.

It does sound better but here's the thing: this is Jeff Bezos. He's one of the most high-profile people on the planet. If his phone was hacked through WhatsApp, he clearly filed a complaint and told them what had happened. They just didn't manage to patch it for over a year and then stated they 'had no way of knowing' even though this clearly proves it happened.

s/after/before/

do you mean 18 months before?

As I mentioned in my other comment, I see no reason to think that CVE-2019-11931 was exploited by NSO Group.

Why do you think it was CVE-2019-11931? The Facebook vs. NSO lawsuit[1] mentions CVE-2019-3568[2]. CVE-2019-3568 was widely reported in May to have been exploited by NSO group[3].

[1] https://context-cdn.washingtonpost.com/notes/prod/default/do...

[2] https://www.facebook.com/security/advisories/cve-2019-3568

[3] https://arstechnica.com/information-technology/2019/05/whats...

This sort of thing blows my mind.

Any rough theories on how this sort of thing can happen? How can an app go from parsing metadata to executing foreign code?

It's called C. It's incredibly hard to write secure code in it.

I thought whatsapp was erlang?

I don’t imagine there being much Erlang in the iOS and Android clients.

Is there any C in WhatsApp?

Yes - all the media decoders are in C

Cool, that actually does sound like a rather large attack surface for an innocent-looking attachment to wind up executing code

Reply on news.ycombinator.com