Skip to main content

Vulnerability in Facebook Messenger for Windows Could Have Allowed Malware Gain Persistence.

Facebook Messenger
Cybersecurity researchers at Reason Labs, the threat research arm of security solutions provider Reason Cybersecurity, disclosed details of a vulnerability they recently discovered in the Facebook Messenger application for Windows.

The vulnerability, which resides in Messenger version 460.16, could allow attackers to leverage the app to potentially execute malicious files already present on a compromised system in an attempt to help malware gain persistent/extended access.

Reason Labs shared its findings with Facebook in April, after which the social media company quickly patched the flaw with the release of an updated version of Facebook Messenger for Windows users via the Microsoft store.

Facebook Messenger

According to researchers, the vulnerable app triggers a call to load Windows Powershell from the C:\python27 path. This path is typically created when installing version 2.7 of the Python and does not commonly exist in most Windows installations.

Attackers can hijack such calls that attempt to load potentially non-existent resources to covertly execute malware. Moreover, since the targeted directory is also in a low-integrity location, malicious programs could access the path without administrator privileges.

To test if the flaw is exploitable, the team created a reverse shell disguised as Powershell.exe and deployed it into the Python directory. They then ran the Messenger app, which triggered the call, successfully executing the reverse shell, thus proving that malicious actors could exploit the flaw for persistent attacks.

Conventionally, attackers employing persistence methods rely on registry keys, scheduled tasks, and services to maintain active access to a system. This particular type of vulnerability is considered to be more complex to exploit.

Attackers need to observe if an app is making an unwanted call or dive deep into an app's binary code to find a function that makes such a call.

Facebook Messenger

The vulnerability has been fixed in version 480.5, which is the most recent release that Reason tested. Users who are running the flawed version should update to the latest release.

While there has been no indication that the flaw has been exploited before Reason's discovery, such vulnerabilities are highly risky.

Malicious actors can use such flaws to maintain access to devices for extended periods. Such persistent access can allow them to perform other hacks, including ransomware implantation and data exfiltration and breaches.

Threat groups also use persistent methods to perform specialized hacks targeting financial institutions, government offices, and other industrial facilities.

In addition, the threat could have been widespread had the vulnerability been exploited. Facebook Messenger has 1.3 billion active users a month. While this figure accounts for all users across devices, many access the service through their Windows-based machines.

This becomes even more worrying considering that messaging apps are seeing significant use during the ongoing coronavirus pandemic. Due to travel restrictions, lockdowns, and forced work-from-home arrangements, users rely heavily on messaging apps and video conferencing tools to communicate and collaborate.

Facebook's Messenger is among the popularly used apps. In March, Facebook reported a 50 percent increase in messaging and a 1,000 percent increase in time-in-group in calls with three or more participants.

THN

#osutayusuf

Comments

Popular posts from this blog

More Than 100 Angry Youths Chased Maracha District Officials Out of Site Meeting Over Corruption.

📸: Some of the angry Youths displaying placards as others walked in to stop the ongoing meeting by Maracha District officials. Story by Osuta Yusuf. Maracha District. 3-February-2025. 📸: Kololo Public Seed Secondary School whose construction project has again stalled. Photo by Osuta Yusuf, Our News Reporter. The angry youths from Vurra Parish, Tara Sub-county in Maracha East constituency, Maracha District have on Monday 3-Feb-2025 chased the entire Maracha District officials out of a site meeting in Kololo Seed Secondary over allegations of corruption stemming from the stalled seed school construction project. Key Maracha District officials who went for the site meeting on Monday 3-Feb-2025 include, the Security department headed by the deputy RDC Koliba Monica Kotevu and Assistant RDC Collins Dramani, the LC5 Chairperson Hon Obitre Stephen together with his DEC Councilors, the accounting  / technical department headed by the CAO Mr Olila Patrick, the Engi...

Escaped Murder Suspect Finally Arrested in Yumbe Regional Referral Hospital, Yumbe District.

Story by Osuta Yusuf. 19-November-2024. 📸: Eyotre Kennedy handcuffed on bed while receiving medication this morning at Yumbe Regional Referral Hospital in Yumbe District. Eyotre Kennedy originating from Etoko village, Nyoroo Parish, Nyadri Sub-county in Maracha District who has for many years been terrorizing residents in his village, has finally been arrested this Monday morning 19-November-2024 while receiving treatment at Yumbe Regional Referral Hospital in Yumbe District following injuries he sustained from Theft mission on Saturday night 16-November-2024 in Owapi village, Azapi parish in Odupi Sub-county, Terego East Constituency in Terego District. Click here on the link  https://informationispowah.blogspot.com/2024/11/fugitive-who-chopped-3-people-killed.html   to read the story on his Theft of Goats in Terego. Upon getting cut on the finger and leg by the Mob as he attempted to fight and overpower owner of the goats he attempted to steal on Saturday night ...

41-Years-Old Man Digs His Own Grave in Maracha District.

Story by Osuta Yusuf.  Maracha District.  📸: The grave been dug by Mr Opiga Michael, a victim of frustration. Photo taken by Osuta Yusuf , on Wednesday 11-September-2024. The residents of Ebapi village, Baria Parish in Nyadri Sub-county, Maracha east constituency, Maracha District are in shock after a 41 year old man started digging his own grave. The man, identified as Mr Opiga Michael, who seems to be frustrated over some challenges in life, started digging his own grave on Tuesday 10-September-2024 until he was stopped by the elders in Nyaria clan. 📸: Opiga Michael, the Victim of Frustration. Photo by Osuta Yusuf , Information is Power. While speaking to our reporter on Wednesday evening 11-September-2024, Mr Opiga Michael, said, his main plan  was to commit suicide after finishing digging the grave for burying himself, explained that, he feels frustrated, abandoned and hated by his own clan people, whom he accused of piling lies against him a...