Video yükleniyor...

Video Yüklenemedi

Ana Sayfaya Dön

A week ago, I reported a privacy vulnerability to Meta which may allow attackers to discover any WhatsApp users' devices details, including online status and operating system. This flaw enables adversaries to accurately target a vulnerable iOS (iPhone) device.

TalBeerySec's profile picture

Tal Be'ery

11,247 subscribers

132,308 görüntüleme • 1 yıl önce •via X (Twitter)

Bilim & TeknolojiHaberler & Politika
LIVE

Anya Rossi• Live Now

Private livecam show

51 Yorum

Cthulhu ( ;,;) profil fotoğrafı
Cthulhu ( ;,;)1 yıl önce

@Meta @WhatsApp Nice work! Thank you!

Tal Be'ery profil fotoğrafı
Tal Be'ery1 yıl önce

@Meta @WhatsApp power to the people

mRr3b00t profil fotoğrafı
mRr3b00t1 yıl önce

@Meta @WhatsApp 🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥

Tal Be'ery profil fotoğrafı
Tal Be'ery1 yıl önce

@Meta @WhatsApp Thanks man, I really appreciate your support

Jonathan Bar Or (JBO) 🇮🇱🇺🇸🇺🇦 profil fotoğrafı
Jonathan Bar Or (JBO) 🇮🇱🇺🇸🇺🇦1 yıl önce

@Meta @WhatsApp Have Meta acknowledged?

Tal Be'ery profil fotoğrafı
Tal Be'ery1 yıl önce

@Meta @WhatsApp "A member of Meta’s security team has seen your report and performed an initial evaluation. We will get back to you once we have more information to share."

V A S I profil fotoğrafı
V A S I1 yıl önce

@yo_yo_yo_jbo @Meta @WhatsApp A member of Meta’s security team has seen your report and performed an initial evaluation. We will get back to you once we have more information to share. Next what response you got ?

Tal Be'ery profil fotoğrafı
Tal Be'ery1 yıl önce

@yo_yo_yo_jbo @Meta @WhatsApp It seems like @Meta @WhatsApp is taking this seriously. #Soon 👀

V A S I profil fotoğrafı
V A S I1 yıl önce

@yo_yo_yo_jbo @Meta @WhatsApp Nice in my case I also got response like that after one day it was closed as N/A

Tal Be'ery profil fotoğrafı
Tal Be'ery1 yıl önce

@yo_yo_yo_jbo @Meta @WhatsApp I had such too 🤷

@smagenil profil fotoğrafı
@smagenil1 yıl önce

@Meta @WhatsApp nice findings!

McG profil fotoğrafı
McG1 yıl önce

@Meta @WhatsApp Great work

Tal Be'ery profil fotoğrafı
Tal Be'ery1 yıl önce

@Meta @WhatsApp Thanks

Yair Lifshitz profil fotoğrafı
Yair Lifshitz1 yıl önce

@Meta @WhatsApp Are you part of the Whastapp security team? If not, where's the acknowledgement.

Tomer W profil fotoğrafı
Tomer W1 yıl önce

@Meta @WhatsApp R e s p e c t

Tal Be'ery profil fotoğrafı
Tal Be'ery1 yıl önce

@Meta @WhatsApp T h a n k s

Saifuddin Amri profil fotoğrafı
Saifuddin Amri1 yıl önce

@Meta @WhatsApp Thanks for the awesome work man. You save the world !

Tal Be'ery profil fotoğrafı
Tal Be'ery1 yıl önce

@Meta @WhatsApp Thanks. Just trying to do my part.

Igal Gofman profil fotoğrafı
Igal Gofman1 yıl önce

@Meta @WhatsApp Nice finding!

Tal Be'ery profil fotoğrafı
Tal Be'ery1 yıl önce

@Meta @WhatsApp Thanks

Gospel profil fotoğrafı
Gospel1 yıl önce

@Meta @WhatsApp Great work !!!

Tal Be'ery profil fotoğrafı
Tal Be'ery1 yıl önce

@Meta @WhatsApp Thanks!

DIBSTER :) profil fotoğrafı
DIBSTER :)1 yıl önce

@Meta @WhatsApp 🔥Big dubs.

raiden profil fotoğrafı
raiden1 yıl önce

@Meta @WhatsApp Impressive

Tal Be'ery profil fotoğrafı
Tal Be'ery1 yıl önce

@Meta @WhatsApp Thanks

Steve Borosh profil fotoğrafı
Steve Borosh1 yıl önce

@Meta @WhatsApp Nice work, friend! 💪

Tal Be'ery profil fotoğrafı
Tal Be'ery1 yıl önce

@Meta @WhatsApp Thanks mate :)

Shaked Klein Orbach 🇮🇱 profil fotoğrafı
Shaked Klein Orbach 🇮🇱1 yıl önce

@mbrg0 @Meta @WhatsApp יש דרך לחסום את זה?

Tal Be'ery profil fotoğrafı
Tal Be'ery1 yıl önce

@mbrg0 @Meta @WhatsApp לא שאני מכיר. לחסום את המשתמש שסורק אותך עובד, אבל איך תדע מראש מי יסרוק אותך

Romeo Whisky Sierra profil fotoğrafı
Romeo Whisky Sierra1 yıl önce

How can normal user have access whatsapp web interface (eg: device management) console?

Tal Be'ery profil fotoğrafı
Tal Be'ery1 yıl önce

This screenshot/capture is of a tool I had created, not of WhatsApp web interface

Romesh profil fotoğrafı
Romesh1 yıl önce

@Meta @WhatsApp Any specific reason to call privacy vulnerability and not security vulnerability? Or both same?

Tal Be'ery profil fotoğrafı
Tal Be'ery1 yıl önce

@Meta @WhatsApp Good Q. There is an overlap.

REni profil fotoğrafı
REni1 yıl önce

@cyb3rops @Meta @WhatsApp Is the online status visible regarding the users privacy settings?

Tal Be'ery profil fotoğrafı
Tal Be'ery1 yıl önce

@cyb3rops @Meta @WhatsApp As far as I can tell, there is no way for users to protect themselves with relevant privacy settings.

REni profil fotoğrafı
REni1 yıl önce

@cyb3rops @Meta @WhatsApp Hmm interesting, would have thought that Settings > Privacy > Last seen & online > set to nobody + same as last seen, made a difference at least..

Tal Be'ery profil fotoğrafı
Tal Be'ery1 yıl önce

@cyb3rops @Meta @WhatsApp It does, but not for this issue. It's not using the user's online status

Voidwalker profil fotoğrafı
Voidwalker1 yıl önce

@Meta @WhatsApp So.. have WhatsApp found any conclusive evidence that anybody was fingerprinted/attacked by this or just the vulns?

Tal Be'ery profil fotoğrafı
Tal Be'ery1 yıl önce

@Meta @WhatsApp We will probably never know for certain

p1tsi profil fotoğrafı
p1tsi1 yıl önce

@Meta @WhatsApp Very curious to have further details, hope you will write something about it soon. Meanwhile, are you by chance using a rooted/jb device or are you directly interact with WhatsApp’s servers?

Tal Be'ery profil fotoğrafı
Tal Be'ery1 yıl önce

@Meta @WhatsApp I plan to write a detailed technical blog post about it, once @WhatsApp fixes it. To test these issues, I built (vibe coded 😅) my own tool, based on Baileys

Michael Bargury profil fotoğrafı
Michael Bargury1 yıl önce

@Meta @WhatsApp that's a really cool find!

Tal Be'ery profil fotoğrafı
Tal Be'ery1 yıl önce

@Meta @WhatsApp Thanks mate. Coming from you it's a real compliment

Gabriel Gegenhuber profil fotoğrafı
Gabriel Gegenhuber1 yıl önce

@Meta @WhatsApp hi Tal! I think this mostly overlaps with the findings we show in this paper: we reported the issue already back in 2024. also, the OS-fingerprinting (based on key-ids) was mentioned in another publication:

Tal Be'ery profil fotoğrafı
Tal Be'ery1 yıl önce

@Meta @WhatsApp Great work! I saw your 2024 paper a few weeks ago and decided to implement it. In my report to @WhatsApp I give credit to you (cannot share it publicly yet). I think I had added some new elements with the fingerprinting, that I cannot share yet

Gabriel Gegenhuber profil fotoğrafı
Gabriel Gegenhuber1 yıl önce

@Meta @WhatsApp so cool, i'm curious about the fingerprinting you found. good luck with the ticket! :) ...i know from experience that it's very hard to get some actual feedback from Meta 😅

Tal Be'ery profil fotoğrafı
Tal Be'ery1 yıl önce

@Meta @WhatsApp been there 😅

Tal Be'ery profil fotoğrafı
Tal Be'ery1 yıl önce

@Meta @WhatsApp got the scars... :)

æ 🧙🏻‍♂️ profil fotoğrafı
æ 🧙🏻‍♂️1 yıl önce

@Meta @WhatsApp Did you get paid a good bounty?

Mike Belshe profil fotoğrafı
Mike Belshe1 yıl önce

@Meta @WhatsApp Thank you!!

Tal Be'ery profil fotoğrafı
Tal Be'ery1 yıl önce

@Meta @WhatsApp Thanks you for your support :)

Benzer Videolar

Is iPhone affected? I have tested yesterday's published WhatsApp vulnerability against latest iOS and it is not affected This WhatsApp security issue affects only Android devices where it allows to access photos during a WhatsApp video call on PIN locked smartphone
0:37

Is iPhone affected? I have tested yesterday's published WhatsApp vulnerability against latest iOS and it is not affected This WhatsApp security issue affects only Android devices where it allows to access photos during a WhatsApp video call on PIN locked smartphone

Mobile Hacker

13,486 görüntüleme • 1 ay önce

Users who have Python installed on their PCs and use WhatsApp Desktop may be exposed to a security risk. A specially crafted .pyz (Python archive) file can be used to execute malicious code upon a single click, potentially compromising the system. A similar vulnerability was previously identified in Telegram Desktop and has since been remediated. At present, Meta does not recognize this behavior as a security issue, which may leave WhatsApp Desktop users at risk of exploitation.
0:20

Users who have Python installed on their PCs and use WhatsApp Desktop may be exposed to a security risk. A specially crafted .pyz (Python archive) file can be used to execute malicious code upon a single click, potentially compromising the system. A similar vulnerability was previously identified in Telegram Desktop and has since been remediated. At present, Meta does not recognize this behavior as a security issue, which may leave WhatsApp Desktop users at risk of exploitation.

H4x0r.DZ 🇰🇵

61,607 görüntüleme • 1 yıl önce

At 0x41con, I talked about how a newer version of Trigon was developed for A7 - A9 and A11 devices. I demoed the following untethered iOS 14 jailbreak, which is 100% reliable on all devices thanks to Trigon - the following video shows it running on an iPhone 6S and an iPhone 7.
0:50

At 0x41con, I talked about how a newer version of Trigon was developed for A7 - A9 and A11 devices. I demoed the following untethered iOS 14 jailbreak, which is 100% reliable on all devices thanks to Trigon - the following video shows it running on an iPhone 6S and an iPhone 7.

Alfie

59,525 görüntüleme • 1 yıl önce

QVAC first demo (android mobile) of its local on-device fine-tuning generalized framework, which aims to bring LORA fine-tuning to any device, scaling from the smallest embedded device to any smartphone, laptop, server, operating system. In combination with WIP multi-node features, we expect QVAC to become the standard for local on-device single/multi node inference and fine-tuning. Imagine a horde of AI agents being able to learn from your emails, notes and messages, maintaining 100℅ privacy, leveraging only your own devices. A P2P private intelligence network at your fingertips. That's how QVAC personal assistant will look like. Future of Intelligence won't be centralized. Infinite Ingelligence vibes.
1:49

QVAC first demo (android mobile) of its local on-device fine-tuning generalized framework, which aims to bring LORA fine-tuning to any device, scaling from the smallest embedded device to any smartphone, laptop, server, operating system. In combination with WIP multi-node features, we expect QVAC to become the standard for local on-device single/multi node inference and fine-tuning. Imagine a horde of AI agents being able to learn from your emails, notes and messages, maintaining 100℅ privacy, leveraging only your own devices. A P2P private intelligence network at your fingertips. That's how QVAC personal assistant will look like. Future of Intelligence won't be centralized. Infinite Ingelligence vibes.

Paolo Ardoino 🤖

142,902 görüntüleme • 11 ay önce

Padawans! Now, add liquidity to any JediSwap pool from any EVM chain with one click. ✅ Thanks to our frens at @widolabs, which enables the easiest onboarding for users to a Starknet dapp 🤝 Check out the last tweet to mint a Galxe NFT to commemorate this event ;)
0:45

Padawans! Now, add liquidity to any JediSwap pool from any EVM chain with one click. ✅ Thanks to our frens at @widolabs, which enables the easiest onboarding for users to a Starknet dapp 🤝 Check out the last tweet to mint a Galxe NFT to commemorate this event ;)

JediSwap

120,066 görüntüleme • 3 yıl önce

Duckworth: "I think he personally is a compromised individual whom our adversaries are watching and digging the dirt on, and this makes him someone who's vulnerable to our adversaries."
0:40

Duckworth: "I think he personally is a compromised individual whom our adversaries are watching and digging the dirt on, and this makes him someone who's vulnerable to our adversaries."

Aaron Rupar

185,371 görüntüleme • 1 yıl önce

It gets even more Sci-Fi! Apple also announced that the future accessibility update will include a new protocol to allow Brain Computer Interfaces (BCIs) to control iOS, iPadOS, and visionOS devices without any physical movements Such as devices from Synchron demoed here:
1:01

It gets even more Sci-Fi! Apple also announced that the future accessibility update will include a new protocol to allow Brain Computer Interfaces (BCIs) to control iOS, iPadOS, and visionOS devices without any physical movements Such as devices from Synchron demoed here:

Brad Lynch

67,089 görüntüleme • 1 yıl önce

Your Headphones Can SPY Hundreds of millions of audio devices are vulnerable to a new Google Fast Pair exploit. Hackers can use this Bluetooth flaw to force pair, track your location, and even listen in on conversations.
2:59

Your Headphones Can SPY Hundreds of millions of audio devices are vulnerable to a new Google Fast Pair exploit. Hackers can use this Bluetooth flaw to force pair, track your location, and even listen in on conversations.

David Bombal

40,000 görüntüleme • 8 ay önce

iPhone Users Warning: Powerful New Hack Can Steal Your Data Without Clicks A dangerous new wave of iPhone hacking is raising global alarm. Advanced spyware like Darksword and Coruna can infect devices simply by visiting compromised websites, no downloads needed. Millions of iPhones running outdated iOS versions remain vulnerable, with attackers targeting users across multiple countries. Even more worrying, some tools can disable camera and microphone alerts, allowing silent surveillance. Experts warn that these powerful exploits are no longer limited to governments and are now reaching cybercriminal networks. Apple has released fixes, but many users have not updated their devices. Is your iPhone already exposed without you knowing? Credit : First Post.
3:48

iPhone Users Warning: Powerful New Hack Can Steal Your Data Without Clicks A dangerous new wave of iPhone hacking is raising global alarm. Advanced spyware like Darksword and Coruna can infect devices simply by visiting compromised websites, no downloads needed. Millions of iPhones running outdated iOS versions remain vulnerable, with attackers targeting users across multiple countries. Even more worrying, some tools can disable camera and microphone alerts, allowing silent surveillance. Experts warn that these powerful exploits are no longer limited to governments and are now reaching cybercriminal networks. Apple has released fixes, but many users have not updated their devices. Is your iPhone already exposed without you knowing? Credit : First Post.

Augadh

10,092 görüntüleme • 6 ay önce

BOOM! I now have a major update to GrokPod and can program just about anything from this miniature device! Up next I will be able to cast the code to any device, all from my voice on one of the smallest screen devices of any use. I also have another new way to capture video and audio! Stay tuned!
1:52

BOOM! I now have a major update to GrokPod and can program just about anything from this miniature device! Up next I will be able to cast the code to any device, all from my voice on one of the smallest screen devices of any use. I also have another new way to capture video and audio! Stay tuned!

Brian Roemmele

34,877 görüntüleme • 26 gün önce

When I think that the iPhone 16 will soon be released, and I who have just acquired a 12 Pro Max (new) with iOS 14.3 🙄. In the meantime, what a joy to get a device and be able to install almost everything you want 😁
0:23

When I think that the iPhone 16 will soon be released, and I who have just acquired a 12 Pro Max (new) with iOS 14.3 🙄. In the meantime, what a joy to get a device and be able to install almost everything you want 😁

Steph63

17,355 görüntüleme • 2 yıl önce

Hackers convince Meta AI to send a code to a 'new' email — possibly how the old Obama White House Instagram may have been hijacked The breach also hit high-value IG usernames like 'hey' and 'jowo' — which are worth over $1M combined Meta says the flaw is now fixed
1:29

Hackers convince Meta AI to send a code to a 'new' email — possibly how the old Obama White House Instagram may have been hijacked The breach also hit high-value IG usernames like 'hey' and 'jowo' — which are worth over $1M combined Meta says the flaw is now fixed

RT

201,715 görüntüleme • 4 ay önce

17 years ago today, Steve Jobs introduced us to the iPhone. "Well, today, we're introducing three revolutionary products of this class. The first one, is a widescreen iPod with touch controls. The second, is a revolutionary mobile phone. And the third, is a breakthrough Internet communications device. So, three things; a widescreen iPod with touch controls, a revolutionary mobile phone and a breakthrough Internet communications device. An iPod, a Phone and an Internet communications device … are you getting it? These are not three separate devices. This is one device – and we are calling it iPhone. Today, Apple is going to reinvent the phone."
1:09

17 years ago today, Steve Jobs introduced us to the iPhone. "Well, today, we're introducing three revolutionary products of this class. The first one, is a widescreen iPod with touch controls. The second, is a revolutionary mobile phone. And the third, is a breakthrough Internet communications device. So, three things; a widescreen iPod with touch controls, a revolutionary mobile phone and a breakthrough Internet communications device. An iPod, a Phone and an Internet communications device … are you getting it? These are not three separate devices. This is one device – and we are calling it iPhone. Today, Apple is going to reinvent the phone."

Brian Solis

18,080 görüntüleme • 2 yıl önce

Major announcements from Google AR & VR this morning including Android XR platform supporting both headsets and glasses. 👇🏽 👾 Android XR is an operating system for spatial computing devices bringing together years of investment in AI, AR, and VR. ♊️ Gemini will be available on devices as an always-ready AI agent to assist your needs. 🥽 Samsung mixed-reality headset, considered to be a mashup of the Meta Quest and Apple Vision Pro, to launch in 2025. 🕶️ Smart glasses, akin to Ray-Ban Meta, including an AR heads-up display actively being field-tested. More at:
2:05

Major announcements from Google AR & VR this morning including Android XR platform supporting both headsets and glasses. 👇🏽 👾 Android XR is an operating system for spatial computing devices bringing together years of investment in AI, AR, and VR. ♊️ Gemini will be available on devices as an always-ready AI agent to assist your needs. 🥽 Samsung mixed-reality headset, considered to be a mashup of the Meta Quest and Apple Vision Pro, to launch in 2025. 🕶️ Smart glasses, akin to Ray-Ban Meta, including an AR heads-up display actively being field-tested. More at:

asim ᯅ

28,112 görüntüleme • 1 yıl önce

Be aware that your photos can be accessed without unlocking your phone when you receive a WhatsApp video call on Android. This is in plain sight. It's not hidden, not a secret feature. Not a hack. This has already been reported to Meta and Google. #Privacy #Security #Android17
0:23

Be aware that your photos can be accessed without unlocking your phone when you receive a WhatsApp video call on Android. This is in plain sight. It's not hidden, not a secret feature. Not a hack. This has already been reported to Meta and Google. #Privacy #Security #Android17

Jose Rodriguez

632,437 görüntüleme • 1 ay önce

Quick announcement for Legacy iOS Collectors, Recently, Apple did something to their activation server (under investigation), and now a lot of A5 devices (iOS 6-9 for now) along with my iPhone 5 on iOS 6 is stuck on an activation loop. DO NOT restore A5-A6 devices at this time.
0:34

Quick announcement for Legacy iOS Collectors, Recently, Apple did something to their activation server (under investigation), and now a lot of A5 devices (iOS 6-9 for now) along with my iPhone 5 on iOS 6 is stuck on an activation loop. DO NOT restore A5-A6 devices at this time.

Ben

45,001 görüntüleme • 1 yıl önce

Big news! Meta has just announced that they're opening up Meta Horizon OS, the operating system powering Quest, to allow others to design more headsets using their ecosystem. Lenovo, Microsoft, and ASUS are among Meta's initial partners. This move could spark a new wave of headsets focused on productivity, entertainment, gaming, exercise and more.
2:54

Big news! Meta has just announced that they're opening up Meta Horizon OS, the operating system powering Quest, to allow others to design more headsets using their ecosystem. Lenovo, Microsoft, and ASUS are among Meta's initial partners. This move could spark a new wave of headsets focused on productivity, entertainment, gaming, exercise and more.

Nathie @ Meta Connect

2,008,139 görüntüleme • 2 yıl önce