Facebook has had a bug bounty program since 2011. Silvanovich disclosed the bug to Facebook on Oct. Exploiting the bug would only take a few minutes however, an attacker would already have to have permissions-i.e., be Facebook “friends” with the user–to call the person on the other end.

Silvanovich provided a step-by-step reproduction of the issue in her report. “If this message is sent to the callee device while it is ringing, it will cause it to start transmitting audio immediately, which could allow an attacker to monitor the callee’s surroundings.” “However, there is a message type that is not used for call set-up, SdpUpdate, that causes setLocalDescription to be called immediately,” she explained. This is rendered in the app by either not calling setLocalDescription until the person being called has clicked the “accept button,” or setting the audio and video media descriptions in the local Session Description Protocol (SDP) to inactive and updating them when the user clicks the button, Silvanovich explained. In a normal scenario, audio from the person making the call would not be transmitted until the person on the other end accepts the call. Natalie Silvanovich, a security researcher at Google Project Zero, discovered the vulnerability, which she said existed in the app’s implementation of WebRTC, a protocol used to make audio and video calls by “exchanging a series of thrift messages between the callee and caller,” she explained a description posted online. Facebook has patched a significant flaw in the Android version of Facebook Messenger that could have allowed attackers to spy on users and potentially identify their surroundings without them knowing.

Messenger+ android