Facebook messenger bug discovered by researcher allowed hackers to listen to Android users surroundings. The bug could have allowed attackers to connect to FB messenger audio call without a person’s knowledge, but it has been fixed now by Facebook.
How Facebook messenger bug allowed hackers to listen to Android users?
According to the researcher Natalie Silvanovich, the bug in the WebRTC protocol caused the issue. The bug of SDP message, which is part of WebRTC, could have auto-approved the WebRTC connection without user interaction. This strange behaviour may have caused the issues for about 1 Billion Android devices.
Usually, callers not able to listen to the audio until receiver accept the call. But with this bug, attackers had to send a unique message known as SdpUpdate to connect and listen to the device before the user answered it.
“If this message is sent to the callee device while it is ringing, it will cause it to start transmitting audio immediately, which could allow an attacker to monitor the callee’s surroundings”, Natalie Silvanovich, member of Google’s Project Zero team, said.
The researcher published the bug discovery method to find the Facebook messenger loophole after Facebook fixed it. The information includes the python script and supporting files to reproduce the issue.
Facebook messenger bug research award:
Facebook messenger bug was found under the Bug Bounty program by researcher Natalie Silvanovich and rewarded with the $60,000. The reward amount donated to the “Givewell” organisation as per twit by Natalie.
Facebook generously awarded a bounty of $60,000 for this bug, which I’m donating to the @GiveWell Maximum Impact Fund https://t.co/JvZt9Fw4nx
— Natalie Silvanovich (@natashenka) November 19, 2020
Under Facebook Bug Bounty program, over 50,000 developers and researches joined since 2011. So far, 130,000 vulnerabilities discovered by 6,900 researchers under the Facebook Bug Bounty reward program. According to Facebook, over $1.98 million paid for over 1,000 bugs discovery this year alone. The discovery of various bugs includes platform like WhatsApp and Instagram as well.
The Bug Bounty program is available for many tech giants, and you can individually register for the program. Once your registration approved by Bug Bounty program, you can start researching loopholes and bugs legally. There are many Bug Bounty programs, but some famous are Bug Crowd and Hacker One.
Conclusion:
There are many tech giants faced issues from bugs in the past, and they have active team members who are specialised in finding the bugs. But sometimes some loopholes missed by mistakes could cause such an issue like Facebook messenger bug.
In October 2019, Natalie Silvanovich found a bug in the iMessage app for iOS that landed up with a bricked device. To solve the issues, users had to wipe data and restore it to function correctly again.
Natalie Silvanovich found WhatsApp bug in Android and iOS device in October 2018. According to research, the bug allowed attackers to take over on the app for answered video call. The bug in the Real-Time Transport Protocol (RTP) raised concerns over user’s privacy in 2018.
Similarly, researchers found zero-click security exploits in the iOS mail app a few months back. The zero-click exploit allowed attackers to take over on iOS Mail App without users consent. The zero-click vulnerability affected both iPhones and iPads that existed from iOS 6, according to researchers.
The Bug Bounty program can help individual researchers to find the bugs for rewards, so it’s a win-win situation. Many tech companies are spending millions of dollars every year on Big Bounty programs to protect their platform from hackers and provide a safe environment to their users.