Defense through Offense: Building a 1-click Calling Exploit targeting Messenger for Android
No ratings
Presented at Hexacon 2024 by
Messenger is one of the most popular mobile messaging applications in the world with over 1 billion users. Messenger contains a significant amount of C and C++ code, much of which is remotely reachable by clients through messaging and calling attack vectors. Additionally, Messenger is transitioning to a default end to end encrypted experience for messaging and calls providing significant privacy benefits but at the same time shifting more of the application’s attack surface from the server to the client. These factors together contribute to the application being an attractive exploitation target. To better understand what exploitation looks like on Messenger, we conducted an exercise to build an end to end exploit assuming a remote attacker. The goals were to understand the state of the application’s exploit mitigations and identify areas for improvement. Exploit development is often nuanced based on the target and we wanted to identify and create primitives that were unique to Messenger. The exercise was successful resulting in the creation of a 1-click calling exploit targeting Messenger for Android. In this presentation, we will first introduce the exploitation scenario and highlight the four internally discovered vulnerabilities we leveraged. These vulnerabilities span features such as calling, messaging, and AR effects. Then we will walk through how we built individual primitives out of these vulnerabilities and chained them together. Specifically, we will explain in detail how we constructed our chain to execute arbitrary code in the Messenger application and how we bypassed modern Android exploit mitigations such as NX pages, ASLR, and the hardened Scudo allocator. Finally, we will walk through the exploit mitigation improvements we identified while building the exploit and how they would have made exploitation much more difficult