Meta Researchers Detail One-Click Messenger Exploit and Defenses
· 34:22 · Watch on YouTube ↗
Summary
Meta researchers chained four fixed vulnerabilities in Messenger for Android to demonstrate one-click code execution, then used the exercise to develop application-hardening measures.
Key points
- The internal exercise reintroduced previously fixed vulnerabilities to test a full exploit chain and identify further defenses.
- The scenario required an attacker to be able to call the victim and the victim to answer; spoofed caller metadata could make the call appear familiar.
- A malicious AR effect exploited an out-of-bounds read to disclose memory and bypass address space layout randomization.
- The chain combined a signaling-message restriction bypass with an out-of-bounds write to hijack control flow and load a shared library sent in an encrypted chat.
- The researchers demonstrated a reverse shell running with the application's access on the victim device.
- Defensive outcomes included attachment-loading restrictions, bounds checks, tighter signaling validation and control-flow integrity protections. The presenters said all four vulnerabilities had been fixed.
Article Details
- Topics
- [01:12] Meta's internal Defense through Offense exercises
- [03:05] Messenger architecture and calling attack surface
- [06:14] One-click exploit scenario and four fixed vulnerabilities
- [08:38] Payload delivery, caller spoofing and heap spraying
- [15:04] AR effect memory disclosure and ASLR bypass
- [23:10] Signaling bypass, memory corruption and code execution
- [30:48] Exploit-driven mitigations and product hardening