TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

You Can't Spell WebRTC Without RCE – Part 1

58 点作者 ementally9 个月前

4 条评论

ec1096859 个月前
Signal should separate WebRTC handling into its own process so that an exploit doesn’t have access to its critical database.<p>A messaging app has almost all the same security concerns as a browser, so the recommendations here apply: <a href="https:&#x2F;&#x2F;developer.apple.com&#x2F;documentation&#x2F;browserenginekit" rel="nofollow">https:&#x2F;&#x2F;developer.apple.com&#x2F;documentation&#x2F;browserenginekit</a>
评论 #41168503 未加载
kelnos9 个月前
This honestly doesn&#x27;t surprise me all that much. More than 10 years ago I had to dive into Chrome&#x27;s WebRTC stack for interop and reverse-engineering purposes (at the time, the WebRTC specs were changing all the time, and were poorly documented). The code was <i>massive</i>; it turns out it&#x27;s a fairly complicated protocol, and dealing with audio and video and handling sessions (even without including a signaling protocol) requires a lot of code (not to mention the use of the then-obscure DTLS security protocol on top of UDP). And that was 12 years ago; I&#x27;m sure WebRTC&#x27;s surface area has only increased since then.<p>I assume Signal uses a different implementation, but I&#x27;m sadly not surprised there are security issues lurking inside it.<p>This bit at the beginning made me chuckle, though:<p>&gt; <i>It’s another average Friday morning and my iPhone shows 705 unread Signal messages</i><p>I feel like I&#x27;m doing communications wrong... if I wake up and find 20 unread messages across all my chat apps, that&#x27;s on the high side for me.
评论 #41154961 未加载
评论 #41156214 未加载
egberts19 个月前
As we dive into Apple iPhone iOS, we show how to build Signal&#x2F;iOS, but first let us show you Signal&#x2F;Android because our Frida tool cannot hook within iOS.<p>So, it is a build instruction.
jauntywundrkind9 个月前
&gt; <i>Next, let’s give ourselves an arbitrary write. To make the exploit a bit simpler, we’ll give ourselves an arbitrary memcpy.</i><p>They took Signal-webrtc &amp; added a vulnerability to it.<p>Maybe maybe maybe there&#x27;s some other means to exploit the lack of time check, but this feels like such a massive &amp; overwhelmingly staked out nothing burger.
评论 #41155491 未加载
评论 #41156169 未加载