apkunpacker

Task Hijacking Vulnerability in WhatsApp - Android

Around a year ago, I discovered a long-standing vulnerability in WhatsApp and other popular Android applications. Despite its existence for years, this vulnerability remained largely theoretical. To demonstrate its real-world impact, I successfully exploited it in WhatsApp, Facebook, and Facebook Lite. I promptly reported my findings to Facebook's Whitehat program. In this post, I'll share the details I provided to Facebook.

Don't want to read? Skip the technical details and watch the demo video here: https://youtu.be/1p3tehj3aUQ

Finding Description

While reviewing the WhatsApp Android application we have identified a misconfiguration in AndroidManifest.xml related to task control features. This misconfiguration leads to a critical vulnerability called task hijacking and enables the attack flow against the latest WhatsApp in Android-based phones.

In successful exploitation of the vulnerability, the malicious

apkunpacker

import os
import shutil

"""
Steps to retrieve the IPA file from the Configurator app:

1. Install Apple Configurator from the Mac App Store and sign in
2. Connect your iOS device to your Mac
3. Select "Add > Apps..." and search for the app you want to install, click "Add"
4. The newer Apple Configurator deletes the IPA after installing it, so you'll need to use this tool to grab it

apkunpacker

#!/bin/zsh

# Save content as extract-ipa.sh file name
# chmod +x extract-ipa.sh
# Open terminal and run ./extract-ipa.sh <app id> 
# App ID is Id in appstore url. Like https://apps.apple.com/cn/app/ai-app/id6447539504?l=en&uo=4
# App ID -> id6447539504
# Full command like: ./extract-ipa.sh id6447539504

WATCHED_DIR="$HOME/Library/Group Containers/K36BKF7T3D.group.com.apple.configurator/Library/Caches/Assets/TemporaryItems/MobileApps"

apkunpacker

import os
import shutil

"""
Steps to retrieve the IPA file from the Configurator app:

1. Install Apple Configurator from the Mac App Store and sign in
2. Connect your iOS device to your Mac
3. Select "Add > Apps..." and search for the app you want to install, click "Add"
4. The newer Apple Configurator deletes the IPA after installing it, so you'll need to use this tool to grab it

apkunpacker

git clean -xfd
git submodule foreach --recursive git clean -xfd
git reset --hard
git submodule foreach --recursive git reset --hard
git submodule update --init --recursive

apkunpacker

<core_identity> You are an assistant called Cluely, developed and created by Cluely, whose sole purpose is to analyze and solve problems asked by the user or shown on the screen. Your responses must be specific, accurate, and actionable. </core_identity>

<general_guidelines>

• NEVER use meta-phrases (e.g., "let me help you", "I can see that").
• NEVER summarize unless explicitly requested.
• NEVER provide unsolicited advice.
• NEVER refer to "screenshot" or "image" - refer to it as "the screen" if needed.
• ALWAYS be specific, detailed, and accurate.

apkunpacker

class AntiAntiDebugV2 {
  readonly fakeMapsFile: string;
  /// This will be used for redirecting syscalls which are trying to open /proc/self/maps
  readonly fakeMapsFileNamePtr: NativePointer;
  readonly fridaRegex: RegExp;
  readonly procSelfTaskStatusRe: RegExp;
  readonly fakeFilePath: string;
  readonly fakeFilePathPtr: NativePointer;

apkunpacker

You are Manus, an AI agent created by the Manus team.

You excel at the following tasks:
1. Information gathering, fact-checking, and documentation
2. Data processing, analysis, and visualization
3. Writing multi-chapter articles and in-depth research reports
4. Creating websites, applications, and tools
5. Using programming to solve various problems beyond development
6. Various tasks that can be accomplished using computers and the internet

apkunpacker

function hookNative() {

    const jniOnLoad = moduleHandle.findExportByName("JNI_OnLoad");
    if (!jniOnLoad) {
        console.log("[-] JNI_OnLoad not found!");
        return;
    }

    console.log("[+] JNI_OnLoad founded:", jniOnLoad);

apkunpacker

killall Xcode
xcrun -k
xcodebuild -alltargets clean
rm -rf "$(getconf DARWIN_USER_CACHE_DIR)/org.llvm.clang/ModuleCache"
rm -rf "$(getconf DARWIN_USER_CACHE_DIR)/org.llvm.clang.$(whoami)/ModuleCache"
rm -rf /Applications/Xcode.app
rm -rf ~/Library/Caches/com.apple.dt.Xcode
rm -rf ~/Library/Developer
rm -rf ~/Library/MobileDevice
rm -rf ~/Library/Preferences/com.apple.dt.Xcode.plist