Facebook Messenger bug allowed Android users to spy on each other

guest · Nov 19, 2020

Facebook Messenger bug allowed Android users to spy on each other
November 19, 2020
https://www.bleepingcomputer.com/ne...g-allowed-android-users-to-spy-on-each-other/

Facebook fixed a critical flaw in the Facebook Messenger for Android messaging app that allowed callers to listen to other users' surroundings without permission before the person on the other end picked up the call.

Facebook Messenger for Android has been installed on more than 1 billion Android devices according to the app's official Play Store page.
This bug could be exploited by attackers by sending a special type of message known as SdpUpdate which would cause the call to connect to the callee's device before being answered.

"If this message is sent to the callee device while it is ringing, it will cause it to start transmitting audio immediately, which could allow an attacker to monitor the callee's surroundings," explains Natalie Silvanovich, a researcher part of Google's Project Zero bug-hunting team.
Click to expand...

Silvanovich found the issue on version 284.0.0.16.119 of Facebook Messenger for Android last month. The researcher also provides Python-based proof-of-concept (PoC) exploit code to reproduce the issue on Project Zero's bug tracker.
Facebook awarded Silvanovich with a $60,000 bounty for finding and disclosing this Messenger for Android bug.
Click to expand...

Log in or Sign up

Facebook Messenger bug allowed Android users to spy on each other

guest Guest

Log in or Sign up

Facebook Messenger bug allowed Android users to spy on each other

guest Guest

Useful Searches