Facebook has reportedly patched a bug in its Messenger app for Android that allowed hackers to call unsuspecting targets and listen to them before they even pick up the audio call.
The Hacker News reports that Facebook has fixed a bug in its Messenger app for Android that allowed hackers to call targets and listen in on them before they even picked up the call. Natalie Silvanovich of Google’s Project Zero bug-hunting team reported the issue to Facebook last month on October 6.
The vulnerability could have granted an attacker who is logged into the Messenger app the ability to simultaneously initiate a call and send a specific message to a target who is signed into both the app as well as another Messenger client like a web browser. Facebook’s Security Engineering Manager Dan Gurfinkel explained: “It would then trigger a scenario where, while the device is ringing, the caller would begin receiving audio either until the person being called answers or the call times out.”
A technical writeup by Silvanovich states that the flaw resides in WebRTC’s Session Description Protocol that defines a standardized format for the exchange of streaming media between two endpoints which allows an attacker to send a special type of message called an “SdpUpdate” that would cause the call to connect to the caller’s device before its answered.- READ MORE
Listen to the insightful Thomas Paine Podcast Below --