Facebook-owned messaging giant WhatsApp has confirmed a vulnerability that allowed hackers to install spyware on smartphones.
While WhatsApp began life as a simple messaging app, it has expanded into all manner of communications — including voice calls, which it has offered since early 2015. According to a report in the Financial Times, malicious code developed by Israeli cyber intelligence firm NSO could be delivered to users’ handsets using an exploit in the voice-call feature on WhatsApp. The code could be deployed regardless of whether the recipient answered the call.
Facebook issued this update late last night with more details on the vulnerability, saying:
A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of SRTCP packets sent to a target phone number.
Tel Aviv-based NSO has long been mired in controversy over its development of mobile surveillance technology, which it says it sells to government agencies to “prevent and investigate terrorism and crime to save thousands of lives around the globe.”
June 5th: The AI Audit in NYC
Join us next week in NYC to engage with top executive leaders, delving into strategies for auditing AI models to ensure fairness, optimal performance, and ethical compliance across diverse organizations. Secure your attendance for this exclusive invite-only event.
Several reports over the past few years have indicated that the technology has been used to target journalists and human rights activists. Back in 2016, Apple issued an iOS update to patch a security flaw after NSO’s technology was apparently used to target the iPhone of human rights activist Ahmed Mansoor.
NSO’s core product, Pegasus, is essentially spyware that can scrape email and text messages, track calls, access a device’s location, and activate the phone’s microphone and camera. It’s worth noting that although WhatsApp was used in this instance to distribute Pegasus, WhatsApp messages — which are encrypted — are not thought to have been impacted.
Timing
A spokesperson confirmed to VentureBeat that WhatsApp found the vulnerability in early May and started issuing a fix to its infrastructure late last week. Though that back-end fix alone should have patched the vulnerability, the company is still recommending that users update WhatsApp to the following latest versions:
- WhatsApp for Android: v2.19.134
- WhatsApp Business for Android: v2.19.44
- WhatsApp for iOS: v2.19.51
- WhatsApp Business for iOS: v2.19.51
- WhatsApp for Windows Phone: v2.18.348
- WhatsApp for Tizen: v2.18.15.
“WhatsApp encourages people to upgrade to the latest version of our app, as well as keep their mobile operating system up to date, to protect against potential targeted exploits designed to compromise information stored on mobile devices,” a spokesperson told VentureBeat. “We are constantly working alongside industry partners to provide the latest security enhancements to help protect our users.”
The timing of this news is notable, coming as NSO faces legal wrangles in Israel over its sale of surveillance technology to oversees governments that may be abusing the technology. Amnesty International and New York University (NYU) are filing a petition today at the District Court of Tel Aviv, in support of existing legal action requesting the ministry of defence (MoD) revoke NSO’s export licence.
“The Israeli MoD has ignored mounting evidence linking NSO Group to attacks on human rights defenders, which is why we are supporting this case,” noted Danna Ingleton, deputy director of Amnesty Tech. “NSO Group sells its products to governments who are known for outrageous human rights abuses, giving them the tools to track activists and critics. As long as products like Pegasus are marketed without proper control and oversight, the rights and safety of Amnesty International’s staff and that of other activists, journalists, and dissidents around the world is at risk.”
According to the Financial Times, a U.K-based human rights lawyer was targeted as recently as Sunday using this WhatsApp exploit — the lawyer has reportedly helped journalists and other activists sue NSO in Israel. It appears the security measures WhatsApp introduced last week may have prevented the attack from succeeding.
A WhatsApp spokesperson confirmed that the company believed a number of individuals had been targeted in this way and that it has briefed several human rights organizations on the matter and also informed U.S. law enforcement.
In a statement issued to the Financial Times, NSO denied having any knowledge of the recent targets of the WhatsApp exploit.
“Under no circumstances would NSO be involved in the operating or identifying of targets of its technology, which is solely operated by intelligence and law enforcement agencies,” the company said. “NSO would not, or could not, use its technology in its own right to target any person or organisation, including this individual [the U.K. lawyer].”
