Preface: I found logic bugs that allow audio or video to be transmitted without user consent in five mobile applications including Signal, Duo and Facebook Messenger, said Natalie Silvanovich.
Background: Bugs in Signal, Google chat apps let attackers spy on users. Such vulnerability is given by programming code, and was not due to WebRTC functionality. Furthermore , expert found that facebook messenger is vulnerable to this matter perhaps they are not using WebRTC. Facebook official say that they use ‘fbthrift’. What is Thrift. Facebook’s branch of Apache Thrift, including a new C++ server.\ \.
For the details of vulnerability. You can found on the following website – https://googleprojectzero.blogspot.com/2021/01/the-state-of-state-machines.html
Reference: Instrumentation technology
Instrumentation technology refers to injecting additional code into the program to collect runtime information. It can be divided into two types:
(1) Source Code Instrumentation (SCI): Additional code is injected into the program source code.
(2) Binary Instrumentation: Extra code is injected into the binary executable file.
●Static Binary Instrumentation (SBI): Insert additional code and data before program execution to generate a permanently changed executable file.
●Dynamic Binary Instrumentation (DBI): Insert additional code and data in real time while the program is running, without any permanent changes to the executable file.