Adventures in Video Conferencing Part 4: What Didn't Work Out with WhatsApp

WhatsApp is another application that supports video conferencing that does not use WebRTC as its core implementation. Instead, it uses PJSIP, which contains some WebRTC code, but also contains a substantial amount of other code, and predates the WebRTC project. I fuzzed this implementation to see if it had similar results to WebRTC and FaceTime.

Overall, our video conferencing research found a total of 11 bugs in WebRTC, FaceTime and WhatsApp. The majority of these were found through less than 15 minutes of mutation fuzzing RTP. We were surprised to find remote bugs so easily in code that is so widely distributed. There are several properties of video conferencing that likely led to the frequency and shallowness of these issues.

Over the past five years, video conferencing support in websites and applications has exploded. Facebook, WhatsApp, FaceTime and Signal are just a few of the many ways that users can make audio and video calls across networks. While a lot of research has been done into the cryptographic and privacy properties of video conferencing, there is limited information available about the attack surface of these platforms and their susceptibility to vulnerabilities. We reviewed the three most widely-used video conferencing implementations. In this series of blog posts, we describe what we found.

Announcement post introducing Project Zero's redesigned blog, explaining the migration, new layout and features, and where readers can find the archive of past security research.

Part 7 of the Windows Registry Adventure series, mapping which Windows components parse registry data and identifying the most promising attack surface for deeper research.

Part one of a macOS audio series: building a fuzzer for CoreAudio by sending Mach messages, covering the attack surface, harness design, and early results.