WhatsApp Discovers ‘Advanced’ Surveillance Hacks

WhatsApp has urged all of its 1.5 billion users to update their software to fix a vulnerability that it said was being actively exploited to implant advanced surveillance tools on users’ devices.

The Facebook-owned company released the fix over the weekend after discovering the vulnerability earlier this month.

The bug was used to implant spyware developed by Israeli developer NSO Group, whose surveillance tools are intended for use by governments and law enforcement agencies, according to an unnamed surveillance software maker cited by the Financial Times.

When attackers rang up a target’s phone, the malicious code would automatically infect the device even if the call was not answered, WhatsApp said in a technical document on the issue.

Update

The attack involved a buffer overflow vulnerability in WhatsApp’s voice over internet protocol (VOIP) stack that allowed remote code execution via a series of specially crafted secure real-time control protocol (SRTCP) packets, WhatsApp said.

The company began rolling out a fix to its servers on Friday, releasing the client update via Google Play on Saturday and on Apple’s App Store on Monday.

WhatsApp’s app store release notes for the latest versions do not mention the security fix.

The company bills its software as providing end-to-end encrypted messaging that can’t be read by outsiders or by WhatsApp itself.

The company acknowledged that the vulnerability had been used to install spyware, without mentioning NSO by name.

“This attack has all the hallmarks of a private company known to work with governments to deliver spyware that reportedly takes over the functions of mobile phone operating systems,” WhatsApp said in a statement.

“We have briefed a number of human rights organisations to share the information we can, and to work with them to notify civil society.”

Targeted attacks

WhatsApp said its own security team initially discovered the bug, and notified human rights groups, select security vendors and the US Department of Justice earlier in May.

The company said it is not yet able to estimate how many WhatsApp users were affected, but that attacks were likely to have been highly targeted and to have affected only select users.

The attacks were carried out by an “advanced cyber actor”, WhatsApp said.

NSO’s flagship product, Pegasus, allows users to take over the target’s microphone and camera and to gather location data.

The company is partly owned by British private equity fund Novalpina Capital, which participated in a leveraged buyout of NSO in February.

NSO said it does not operate Pegasus itself and does not determine how it is used.

“NSO’s technology is licensed to authorised government agencies for the sole purpose of fighting crime and terror,” the group said.

“NSO would not or could not use its technology in its own right to target any person or organisation.”

But Amnesty International, which alleges it has been targeted by NSO’s tools in the past, told the BBC that NSO should be held accountable for the way in which its products are used.

On Tuesday the human rights group is to appear before a Tel Aviv court to call on Israel’s Ministry of Defence to revoke NSO’s export licence.

Matthew Broersma

Matt Broersma is a long standing tech freelance, who has worked for Ziff-Davis, ZDnet and other leading publications

Recent Posts

TikTok ‘Halts E-Commerce Expansion Plans’

TikTok reportedly scraps plans to expand TikTok Shop livestream commerce in Europe and US after…

2 hours ago

European Parliament Passes Landmark Tech Regulations

European Parliament votes to adopt Digital Markets Act and Digital Services Act, but campaigners warn…

2 hours ago

Indian Economic Police Raid Offices Of Smartphone Maker Vivo

Indian economic crime agency Enforcement Directorate raids dozens of locations across India belonging to China's…

4 hours ago

French Music Service Deezer Slumps On Market Debut

Spotify and Apple Music competitor Deezer falls below opening price after long-delayed IPO in Paris…

4 hours ago

Foxconn Expects Stronger Sales In Spite Of Economic Gloom

iPhone manufacturer Foxconn revises full-year expectations upward amidst strong consumer and data centre demand, bucking…

6 hours ago

Samsung ‘To See Profits Jump’ On Data Centre Demand

Industry analysts expect Samsung's profits to jump 15 percent for the second quarter as strong…

6 hours ago