Rust at Scale: An Added Layer of Security for WhatsApp

Key Actionable Insights

1

When processing untrusted inputs (media files, user uploads, network data), prioritize using memory-safe languages like Rust for the parsing layer. WhatsApp found that the majority of their high-severity vulnerabilities came from memory safety issues in C/C++ code that handled untrusted data.

This is especially critical for code that runs automatically without user interaction, such as media download handlers, file format validators, and content parsers.

2

Use differential fuzzing and parallel development when migrating critical libraries from C/C++ to Rust, rather than attempting incremental rewrites. WhatsApp developed the Rust version alongside the C++ version, using differential fuzzing and extensive tests to ensure behavioral compatibility.

This approach allows you to validate correctness before cutting over and avoids the risk of introducing subtle behavioral differences that an incremental rewrite might miss.

3

Implement layered media file validation that goes beyond format compliance, including checks for file type masquerading (spoofed extensions/MIME types), embedded malicious content within structurally valid files, and risk indicators specific to high-risk formats like PDFs.

WhatsApp's Kaleidoscope system demonstrates that format checks alone won't stop every attack, but this defense-in-depth approach mitigates many threats from malicious clients and attachments.

4

Don't rely solely on OS-level security patches to protect your users. Build application-level defenses that can be deployed independently and more rapidly than OS updates. WhatsApp learned this lesson from the 2015 Stagefright vulnerability, where users took months to update their operating systems.

Application-level media validation gave WhatsApp the ability to protect users from OS vulnerabilities much faster than waiting for OS patches to propagate through device ecosystems.

5

When adopting Rust for cross-platform deployment, plan for the initial binary size increase from the Rust standard library and invest in build system support for all target platforms early. WhatsApp treated this as a long-term bet that paid off across Android, iOS, Mac, Web, and Wearables.

The upfront investment in build infrastructure enables broader adoption of Rust across the organization over time, as WhatsApp is now accelerating Rust adoption to other teams and products.

6

Adopt a three-pronged strategy for reducing memory safety risk in existing codebases: minimize attack surface, invest in hardening remaining C/C++ code (CFI, hardened allocators, safer APIs), and default to memory-safe languages for all new code.

This parallel approach addresses both the legacy codebase and future development, ensuring that security improvements don't wait for a complete rewrite while progressively reducing overall risk.