Viber vulnerability to listen to someone else's conversation

I stumbled upon the opportunity to listen to other people's conversations in Viber in early October 2016. The vulnerability seemed to me not too pleasant, so I contacted the support team and described an algorithm for reproducing the non-standard behavior of the messenger.

I am writing this publication in the hope of attracting the attention of the Habrasociety and its wider publicity in the hope that this will prompt developers to fix this annoying bug, as communication via email with Viber support did not bring any results.


Initial data

Two subscribers talk to each other through Viber, let's call them A and B. During the conversation, subscriber A receives a call, but not through Viber, but through a mobile network. Subscriber A answers the call, thereby subscriber B is on hold.

How to eavesdrop on caller A?

Subscriber B being on hold presses the “Hold” button twice, thereby setting and removing the hold mode for his part, this option is available when talking on a mobile phone or tablet, I did not find such a button in the stationary client.

Having done these actions, subscriber B hears the conversation of subscriber A, though without the opportunity to participate in it. Subscriber A does not understand that they are already “eavesdropping” at this moment and when he finishes talking on the mobile network, he returns to Viber to continue the dialogue with subscriber B.

This problem is reproduced on Android, I have no way to check on iOS.

This issue was sent in support of Viber on October 4, 2016 and received the number # 2620428. On November 22, I reminded them that 2 Viber updates had already been released since I sent the first letter, but the problem has not been fixed.

The answer to the second letter was received only on November 28:

We sincerely regret that you encountered this problem when using Viber. We are currently continuing to investigate this issue. As soon as the results are obtained, we will definitely inform you about it. Thank you for your patience.

Best Regards,
Trinity L.
Viber Support Team
Quick question? Tweet to @ViberHelp

To date, the problem has remained in its place. I hope that this post will help to find the strength and means to eliminate this bug.

While writing an article, the problem was fixed in an update that came on the phone yesterday, but it may still be relevant for UPDs that were not updated

: from the messages in the comments, it became clear that the problem has not yet been fixed for iOS and BlackBerry .