But media files that exploit parsers is the bigger issue. Errors in parsing have allowed for code execution, etc, in whatever context the parser runs; look into Stagefright and the many similar exploits before and after. Accepting media files from anywhere without user interaction is pretty risky. WhatsApp has a media file sanitizer, but it may not catch everything.
Disclosure: I worked at WhatsApp until 2019; but not on the media file sanitizer.
If the file is placed in your phone's media folder, it may be displayed when you use media features on your phone. It may also be processed automatically by other software; maybe to generate a thumbnail for use in the system media view or other reasons.
The implication being that if the attacker could also craft a malicious payload that would cause a buffer overflow, they could chain the exploits to get remote code execution on the client.
While anyone can perform the attack described in the bug, it takes a very sophisticated attacker to craft the payload that can exploit Android’s media library.
Sure, excess data use.
But media files that exploit parsers is the bigger issue. Errors in parsing have allowed for code execution, etc, in whatever context the parser runs; look into Stagefright and the many similar exploits before and after. Accepting media files from anywhere without user interaction is pretty risky. WhatsApp has a media file sanitizer, but it may not catch everything.
Disclosure: I worked at WhatsApp until 2019; but not on the media file sanitizer.
But this exploit is about downloading the media. There doesn't seem to be a way to view it to trigger parsing it?
Edit: Rereading the big report it seems implied that it is not just talking about downloading the images, but also trying to show them.
If the file is placed in your phone's media folder, it may be displayed when you use media features on your phone. It may also be processed automatically by other software; maybe to generate a thumbnail for use in the system media view or other reasons.
The implication being that if the attacker could also craft a malicious payload that would cause a buffer overflow, they could chain the exploits to get remote code execution on the client.
While anyone can perform the attack described in the bug, it takes a very sophisticated attacker to craft the payload that can exploit Android’s media library.