A Bug in Facebook Messenger for Windows Could’ve Helped Malware Gain Persistence

The vulnerability, which resides in Messenger version 460.16,
could allow attackers to leverage the app to potentially execute
malicious files already present on a compromised system in an
attempt to help malware gain persistent/extended access.

Reason Labs shared^[2] its findings with
Facebook in April, after which the social media company quickly
patched the flaw with the release of an updated version of Facebook
Messenger for Windows users via the Microsoft store.

Attackers can hijack such calls that attempt to load potentially
non-existent resources to covertly execute malware. Moreover, since
the targeted directory is also in a low-integrity location,
malicious programs could access the path without administrator
privileges.

To test if the flaw is exploitable, the team created a reverse
shell disguised as Powershell.exe and deployed it into the Python
directory. They then ran the Messenger app, which triggered the
call, successfully executing the reverse shell, thus proving that
malicious actors could exploit the flaw for persistent attacks.

Conventionally, attackers employing persistence methods rely on
registry keys, scheduled tasks, and services to maintain active
access to a system. This particular type of vulnerability is
considered to be more complex to exploit.

Attackers need to observe if an app is making an unwanted call
or dive deep into an app’s binary code to find a function that
makes such a call.

While there has been no indication that the flaw has been
exploited before Reason’s discovery, such vulnerabilities are
highly risky.

Malicious actors can use such flaws to maintain access to
devices for extended periods. Such persistent access can allow them
to perform other hacks, including ransomware implantation and data
exfiltration and breaches.

Threat groups also use persistent methods to perform specialized
hacks targeting financial institutions, government offices, and
other industrial facilities.

In addition, the threat could have been widespread had the
vulnerability been exploited. Facebook Messenger has 1.3 billion active
users^[3] a month. While this
figure accounts for all users across devices, many access the
service through their Windows-based machines.

This becomes even more worrying considering that messaging apps
are seeing significant use during the ongoing coronavirus pandemic.
Due to travel restrictions, lockdowns, and forced work-from-home
arrangements, users rely heavily on messaging apps and video
conferencing tools to communicate and collaborate.

Facebook’s Messenger is among the popularly used apps. In March,
Facebook reported a 50 percent
increase^[4] in messaging and a 1,000
percent increase in time-in-group in calls with three or more
participants.

^[1]