Reason Labs researchers discovered a vulnerability in the Facebook Messenger app for Windows.
The vulnerability, which is present in Messenger version 460.16, could allow attackers to exploit the application to execute potentially malicious files that already exist on a compromised system, in an attempt to help the malware gain persistent access.
According to the researchers, the vulnerable application triggers a request to load Windows Powershell from the path C:\python27. This path is usually created when installing Python version 2.7 and is not typically present in most Windows installations.
Malicious actors can infiltrate such requests that attempt to load potentially non-existent resources to silently execute malicious software.
Reason Labs researchers discovered this bug in the Facebook Messenger app, version 460.16, which was fixed with version 480.5.
The Facebook Messenger application was used for Persistence
An attacker can gain access to these requests without requiring administrator privileges.
Noticing this detail, the researchers decided to reverse engineer the shell with msfvenom, creating a new payload and changing the name to Powershell.exe to impersonate the messenger application request.
By using the Persistence method, the creator of the malicious system can also use the system to exploit other systems on the local network or at a remote location.
The complexity of the Persistence method is determined by the attackers based on the privileges of the target machine.
The coronavirus pandemic has pushed most of the world's population to spend more time online, while the use of chat apps has seen a 40% increase. Facebook alone reported a 70% increase and Messenger a 50%.
With the spread of COVID-19 and the measures taken to contain it, many employers have asked their employees to work from home. This has resulted in an increase in the use of video conferencing applications, as well as social media.
