Facebook has reportedly patched a bug in its Messenger app for Android that allowed hackers to call unsuspecting targets and listen to them before they even pick up the audio call.
The Hacker News reports that Facebook has fixed a bug in its Messenger app for Android that allowed hackers to call targets and listen in on them before they even picked up the call. Natalie Silvanovich of Google’s Project Zero bug-hunting team reported the issue to Facebook last month on October 6.
The vulnerability could have granted an attacker who is logged into the Messenger app the ability to simultaneously initiate a call and send a specific message to a target who is signed into both the app as well as another Messenger client like a web browser. Facebook’s Security Engineering Manager Dan Gurfinkel explained: “It would then trigger a scenario where, while the device is ringing, the caller would begin receiving audio either until the person being called answers or the call times out.”
A technical writeup by Silvanovich states that the flaw resides in WebRTC’s Session Description Protocol that defines a standardized format for the exchange of streaming media between two endpoints which allows an attacker to send a special type of message called an “SdpUpdate” that would cause the call to connect to the caller’s device before its answered.
In 2019, Apple’s FaceTime experienced a similar issue where hackers could listen in on users that they called before the user answered the call.
“First, you call someone on FaceTime. Next, before they answer, swipe up and add yourself to the call. That’s it. You can hear through the person’s phone, all without them answering the call,” explained Mashable reporter Jack Morse at the time.
Read more at Breitbart News here.
Lucas Nolan is a reporter for Breitbart News covering issues of free speech and online censorship. Follow him on Twitter @LucasNolan or contact via secure email at the address lucasnolan@protonmail.com
COMMENTS
Please let us know if you're having issues with commenting.