Memory tagging detected. May be a system compromise?

wuseman

CGG
Yeah, but how? Only WhatsApp can access the WhatsApp cookies.

CGG

wuseman lol... Whatsapp , instagram are one of the most exploited platforms ever... But i use it for work.
So i have to deal with this.

CGG

jacksmith well this is whatsapp from google store after a successful session stole which disconected my session in whatsapp. I do exactly as you say and evento can been seen in the log i pasted. User15. Another user for whatsapp. But as i never seen a memory tag message before and this happened exactly after my account stolen.. Something is not correct. I will never disable memory tagging for whatsapp.

wuseman

CGG
WhatsApp isn't easily exploited. Do you have a source for this crazy claim?

Stealing the WhatsApp session token on GrapheneOS would require a GrapheneOS vulnerability.

CGG

jacksmith i agree with you. Whatsapp is one of those worst bugged apps. But never in months, heavy using it, i received this tagging notification. Just exactly when i was under attack... Its curious..

GrapheneOS

CGG This isn't related to memory tagging. It's very likely a null pointer dereference leading to the crash, although what caused that is unclear. You can tell it's a null pointer dereference because the fault address is so close to 0 meaning that it's likely an offset into a large structure or array from 0. 0x0000000000001013 is 4115, as in 4115 bytes from the start of the address space, which is within the reserved region for this purpose. This is some form of memory corruption bug in WhatsApp but it's being caught by the OS. If you have memory tagging enabled for user installed apps, then it's not a use-after-free causing this via the zero-on-free protection since that would be caught by memory tagging in any typical case. Therefore, it's likely some other kind of bug leading to a null pointer dereference.

CGG

GrapheneOS thanks for the explanation. I use memory tag for all applications and users. Thanks. I was thinking, after the attack the hacker may have use some corrupted message to prevent me from recover my account by sending something to overflow the application crashing it... There are tools that are available that do those crashes.

CGG

wuseman make a little research to find out how bugged whatsapp is. Its prohibited from use by some US gov agencies. It has nothing related with graphene. Sessions cookies are managed by the APP not by the OS.
There are hundreds if not 1000 tools that exploit whatsapp. Its not my first time... Already happened to me more than once.

wuseman

CGG
No, I'm not gonna "make a little research" about something that you and you alone are claiming here.

Yes, session cookies are managed by the app and not the OS. So how would someone steal them from you?

CGG

Despite the time from the log pasted and the notification events diferent, this is the graphene notification sent to me at the same time the log was generated when the attack was happening. I just cant explain the time difference between the log and notifications.

https://imgur.com/a/3A0AA3P

Oh and sorry.. Its in portuguese...

CGG

I have never seen whatapp try to use native code debugging also before today.

matchboxbananasynergy

CGG This isn't new.

locked

I have memory tagging enabled for WhatsApp and it is always crashing, it just shuts down, particularly when i turn phone on, but it' consistent. I deal with it because i don't want to turn off memory tagging.

userofgos

locked Yeah I get it all the time too. On another note, does calling on WhatsApp work without the phone permission?

I used to have Exploit protection compatibility mode turned on for WhatsApp but decided to try disabling it again and seeing if it's usable with MTE, Native code debugging disabled, Dynamic code loading via memory and storage disabled.

locked

userofgos I am uncertain about that, I don't worry too much about the phone app, since I don't have a sim card, and I am always on airplane mode. However whatsapp calls do work without giving it network access.

userofgos

locked I'll do some tests and see what happens.

matchboxbananasynergy

People get memory tagging crashes with Whatsapp frequently. It's a badly written app. It's likely not an indication of compromise, but rather an indication of bad code in Whatsapp.

CGG

wuseman good luck to you... P****** graphite hacking solution malware thanks your lack of interest. Dont expect me giving you sensitive information about security breaches.

Matthai

I just got "Memory tagging detected an error in Signal". I opened issue on Signal Github.

Anyway, I have a question... does the extended crash log contain private information? Is it safe to share the log?

I can see several sections like memory near x0:, so I guess, there could be some crypto material or other secure data in the logs... Or I am wrong?

other8026

Matthai I can see several sections like memory near x0:

I think it depends on what's causing the crash, but I'd suggest not including this part if you're concerned about leaking something private.

DeletedUser370

Matthai I just got "Memory tagging detected an error in Signal". I opened issue on Signal Github.

I see that Signal already marked the issue as "acknowledged", so hopefully there is ongoing work on the bug. With a previous report Signal fixed the issue very quickly. Thanks a lot for reporting this to them! Reporting issues like this keeps everyone more secure.

DeletedUser370

Matthai Anyway, I have a question... does the extended crash log contain private information? Is it safe to share the log?

Here is what GrapheneOS has to say about the type of "extended crash log" you are referring to, which are called "tombstones":

From https://grapheneos.org/usage#bugs-uncovered-by-security-features

[…] plain text 'tombstones' with logs, tracebacks, address space layout, register content and a tiny bit of context from memory from areas that are interesting for debugging. This may contain some sensitive data. Feel free to provide only the tombstone for the relevant crash and filter out information you don't want to send. However, it will be more difficult to debug if you provide less of the information. If the app doesn't work with sensitive information, just send the whole tombstone.