Monday, March 8, 2021
35 C
Abuja
Monday, March 8, 2021

A Bug in Facebook Messenger for Windows Could’ve Helped Malware Gain Persistence

Must read

Diaspora Remittances: Beneficiaries To Get N5 Incentive For Every USD Received, Says CBN

A file photo of US dollar notes. The Central Bank of Nigeria (CBN) has introduced the ‘CBN Naira 4 Dollar Scheme’ in its bid to...

The Next Wave: Can Africans afford it?

MARCH 7, 2021 This newsletter is a weekly in-depth analysis of tech and innovation in Africa that will serve as a post-pandemic guide. Subscribe here...

Reps’ bill mandating presidential address on insecurity, economy, others underway

…Address to hold every 6 months after passage of annual budget …Wants NIN compulsory for voters registration By Levinus Nwabughiogu The House of  Representatives will soon debate...

Cybersecurity researchers at Reason Labs, the threat research arm of security solutions provider Reason Cybersecurity, today disclosed details of a vulnerability they recently discovered in the Facebook Messenger application for Windows.

The vulnerability, which resides in Messenger version 460.16, could allow attackers to leverage the app to potentially execute malicious files already present on a compromised system in an attempt to help malware gain persistent/extended access.

Reason Labs shared its findings with Facebook in April, after which the social media company quickly patched the flaw with the release of an updated version of Facebook Messenger for Windows users via the Microsoft store.

Facebook Messenger

According to researchers, the vulnerable app triggers a call to load Windows Powershell from the C:python27 path. This path is typically created when installing version 2.7 of the Python and does not commonly exist in most Windows installations.

Attackers can hijack such calls that attempt to load potentially non-existent resources to covertly execute malware. Moreover, since the targeted directory is also in a low-integrity location, malicious programs could access the path without administrator privileges.

To test if the flaw is exploitable, the team created a reverse shell disguised as Powershell.exe and deployed it into the Python directory. They then ran the Messenger app, which triggered the call, successfully executing the reverse shell, thus proving that malicious actors could exploit the flaw for persistent attacks.

Conventionally, attackers employing persistence methods rely on registry keys, scheduled tasks, and services to maintain active access to a system. This particular type of vulnerability is considered to be more complex to exploit.

Attackers need to observe if an app is making an unwanted call or dive deep into an app’s binary code to find a function that makes such a call.

Facebook Messenger

The vulnerability has been fixed in version 480.5, which is the most recent release that Reason tested. Users who are running the flawed version should update to the latest release.

While there has been no indication that the flaw has been exploited before Reason’s discovery, such vulnerabilities are highly risky.

Malicious actors can use such flaws to maintain access to devices for extended periods. Such persistent access can allow them to perform other hacks, including ransomware implantation and data exfiltration and breaches.

Threat groups also use persistent methods to perform specialized hacks targeting financial institutions, government offices, and other industrial facilities.

In addition, the threat could have been widespread had the vulnerability been exploited. Facebook Messenger has 1.3 billion active users a month. While this figure accounts for all users across devices, many access the service through their Windows-based machines.

This becomes even more worrying considering that messaging apps are seeing significant use during the ongoing coronavirus pandemic. Due to travel restrictions, lockdowns, and forced work-from-home arrangements, users rely heavily on messaging apps and video conferencing tools to communicate and collaborate.

Facebook’s Messenger is among the popularly used apps. In March, Facebook reported a 50 percent increase in messaging and a 1,000 percent increase in time-in-group in calls with three or more participants.

- Advertisement -

More articles

LEAVE A REPLY

Please enter your comment!
Please enter your name here

- Advertisement -

Latest article

Diaspora Remittances: Beneficiaries To Get N5 Incentive For Every USD Received, Says CBN

A file photo of US dollar notes. The Central Bank of Nigeria (CBN) has introduced the ‘CBN Naira 4 Dollar Scheme’ in its bid to...

The Next Wave: Can Africans afford it?

MARCH 7, 2021 This newsletter is a weekly in-depth analysis of tech and innovation in Africa that will serve as a post-pandemic guide. Subscribe here...

Reps’ bill mandating presidential address on insecurity, economy, others underway

…Address to hold every 6 months after passage of annual budget …Wants NIN compulsory for voters registration By Levinus Nwabughiogu The House of  Representatives will soon debate...

“Happy International Womens Day”: Ngozi Okonjo

57 minutes wey don passWia dis foto come from, TWITTERWetin we call dis foto, International Women DayEvery March 8th African women dey join di...