CVE-2019-18800

Viber through 11.7.0.5 allows a remote attacker who can capture a victim's internet traffic to steal their Viber account, because not all Viber protocol traffic is encrypted. TCP data packet 9 on port 4244 from the victim's device contains cleartext information such as the device model and OS version, IMSI, and 20 bytes of udid in a binary format, which is located at offset 0x14 of this packet. Then, the attacker installs Viber on his device, initiates the registration process for any phone number, but doesn't enter a pin from SMS. Instead, he closes Viber. Next, the attacker rewrites his udid with the victim's udid, modifying the viber_udid file, which is located in the Viber preferences folder. (The udid is stored in a hexadecimal format.) Finally, the attacker starts Viber again and enters the pin from SMS.

Viber through 11.7.0.5 allows a remote attacker who can capture a victim's internet traffic to steal their Viber account, because not all Viber protocol traffic is encrypted. TCP data packet 9 on port 4244 from the victim's device contains cleartext information such as the device model and OS version, IMSI, and 20 bytes of udid in a binary format, which is located at offset 0x14 of this packet. Then, the attacker installs Viber on his device, initiates the registration process for any phone number, but doesn't enter a pin from SMS. Instead, he closes Viber. Next, the attacker rewrites his udid with the victim's udid, modifying the viber_udid file, which is located in the Viber preferences folder. (The udid is stored in a hexadecimal format.) Finally, the attacker starts Viber again and enters the pin from SMS.

Viber hasta la versión 11.7.0.5 permite a un atacante remoto que puede capturar el tráfico de Internet de una víctima robar su cuenta de Viber, porque no todo el tráfico del protocolo de Viber está encriptado. El paquete de datos TCP 9 en el puerto 4244 del dispositivo de la víctima contiene información de texto claro, como el modelo del dispositivo y la versión del sistema operativo, IMSI, y 20 bytes de udid en formato binario, que se encuentra en el desplazamiento 0x14 de este paquete. Luego, el atacante instala Viber en su dispositivo, inicia el proceso de registro para cualquier número de teléfono, pero no ingresa un pin de SMS. En cambio, cierra Viber. Luego, el atacante reescribe su udid con el udid de la víctima, modificando el archivo viber_udid, que se encuentra en la carpeta de preferencias de Viber. (El udid se almacena en un formato hexadecimal). Finalmente, el atacante inicia Viber nuevamente e ingresa el pin desde SMS.