Exploits, Tools & Data Recovery · Bug Classes & Mitigations · Lesson 5 of 5

Challenge: The Triage Meeting

Sort three real-world style bug reports and pick the right defenses for each.

Report one: the sticker preview

Dana just joined the security team at a company that makes ChatNest, a messaging app for Android and iPhone. At her first triage meeting, the team reviews three reports from its bug bounty program.

Report one: ChatNest shows a preview of every sticker that arrives, before the user opens the chat. The preview code is written in C++. A researcher found that a sticker claiming to be 64 pixels wide, but carrying far more data than that, makes the code keep copying data past the end of the space it reserved, overwriting whatever sits next to it. The researcher writes that this could let an attacker run their own code inside the preview process, without the recipient tapping anything.

Dana's manager asks her to classify the bug before the team decides what to do.

Report two: the quick-reply screen

Report two is on Android. ChatNest has an exported activity called QuickReply that sends a message from the user's account. It was meant for ChatNest's own notification buttons, but it never checks who started it. Any app on the phone can open it and send messages as the user.

A senior engineer says the team is already planning to rewrite ChatNest's native code in Rust, so this one will go away on its own.

Report three: the second bug

Report three comes from the same researcher as report one. They explain that taking full control of a phone would need more than the sticker bug. The preview process runs in a tightly limited sandbox, and they also had trouble because the locations of the system libraries they wanted to reuse changed every time the process started, so they needed another bug that revealed the layout.

Dana's manager asks which defense caused that second problem.

The plan

The team has to agree on a plan before the meeting ends. Someone points out that the sandbox and randomization already slowed the researcher down, so maybe report one can wait. Someone else wants to pause all bug fixes until a full rewrite is done, so the work only happens once. A third person notes that a new version of the sticker parser is already on the roadmap for next quarter.

Dana's manager writes four options on the whiteboard and asks her to pick the strongest one, based on everything from this course.