WhatsApp Has Exposed Phones To Israeli Spyware - Update Your Apps Now!
On Monday, WhatsApp admitted a major cybersecurity breach that has enabled targeted spyware to be installed on phones through voice calls. The security vulnerability affects both iPhone and Android devices, with malicious code (allegedly) from Israel's NSO Group, transmitted whether or not a user answers an infected call.
Facebook has suffered a multitude of security and privacy breaches in the last year, but this news that a government-grade intelligence collection application had targeted the company's WhatsApp application is different. WhatsApp is Facebook's flagship messaging application and is lauded for its end-to-end encryption, both for messaging and voice calls. As a result, it has become a standard communications platform for government and security officials in many countries around the world.
WhatsApp told the Financial Times, which broke the story, that "the attack has all the hallmarks of a private company known to work with governments to deliver spyware that reportedly takes over the functions of mobile phone operating systems. We have briefed a number of human rights organizations to share the information we can, and to work with them to notify civil society."
WhatsApp engineers had been working round the clock to close the security loophole that was discovered early this month, and the company started to deploy a fix to servers on Friday and to customers on Monday. According to the Financial Times, a WhatsApp spokesperson said "a number in the dozens would not be inaccurate" in terms of impacted users.
The WhatsApp vulnerability is a buffer overflow weakness, enabling malicious code to be inserted into data packets sent during the process of starting a voice call. When the data is received, WhatsApp's internal buffer is forced to overflow, overwriting other parts of the app's memory, and control is given over to the application.
Or as Facebook somewhat drily said: "A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of SRTCP packets sent to a target phone number. The issue affects WhatsApp for Android prior to v2.19.134, WhatsApp Business for Android prior to v2.19.44, WhatsApp for iOS prior to v2.19.51, WhatsApp Business for iOS prior to v2.19.51, WhatsApp for Windows Phone prior to v2.18.348, and WhatsApp for Tizen prior to v2.18.15."
Ironically, on Monday Amnesty International said that it was "supporting legal action to take the Israeli Ministry of Defence (MoD) to court, to demand that it revokes the export license of NSO Group, an Israeli company whose spyware products have been used in chilling attacks on human rights defenders around the world. In a petition to be filed tomorrow at the District Court of Tel Aviv, approximately 30 members and supporters of Amnesty International Israel and others from the human rights community set out how the MoD has put human rights at risk by allowing NSO to continue exporting its products."
"NSO Group sells its products to governments who are known for outrageous human rights abuses, giving them the tools to track activists and critics," said Amnesty's Danna Ingleton. In August 2018, an Amnesty staff member was targeted by NSO's Pegasus, software that has also been linked to attacks in Saudi Arabia, Mexico and the United Arab Emirates. "The attack on Amnesty International was the final straw," Ingleton added.
NSO's Pegasus software is intended for use by governments as a collection tool, enabling over the air access to devices. The software can target the microphone, camera and location data from a device, and has been described as the most sophisticated smartphone hack of all times. The fact that the Israeli company has been accused of selling the technology to countries like Saudi Arabia and the UAE is clearly interesting given the geopolitical context.
NSO told the newspaper that it "vetted customers and investigated abuse". Asked about the WhatsApp news, NSO said it was "investigating" and that "under no circumstances would NSO be involved in the operating or identifying of targets of its technology, which is solely operated by intelligence and law enforcement agencies. NSO would not, or could not, use its technology in its own right to target any person or organization."
Whether this impacts the trust in the security of the WhatsApp application across its 1.5 billion users we are about to find out. It is unlikely. Albeit, again, the likes of Signal and Telegram will be major beneficiaries of this news, especially amongst groups of users where communications security is critical.
In a statement, WhatsApp said "we encourage people to upgrade to the latest version of our app, as well as keep their mobile operating system up to date, to protect against potential targeted exploits designed to compromise information stored on mobile devices."
source forbes
Industry: Cyber Security News
Latest Jobs
-
- Lead CyberArk deployment Consultant
- London
- Upto £80,000 plus benefits
-
CyberArk Consultant is needed to be responsible for leading the deployment of CyberArk solutions for this expanding IT services business, You will work with customer both pre and post sales, getting involved in CyberArk Solution Design, helping to create CyberArk Strategic Roadmaps, on-boarding accounts, product and process integration into the CyberArk Solution and Proviso of Installation and technical Documentation. We are looking for this individual to have experience in: Installation of CyberArk PAS for V11.X and V12.X (Vault, DR Vault, Central Policy Manager and Password Vault Web Access) Upgrade of CyberArk from V9 and V10 (Vault, DR Vault, Central Policy Manager and Password Vault Web Access) Installation and Upgrade of Privilege Session Manager and Privilege Session Manager Proxy As some of your client will be government site, all individual will need to be put through SC clearance, therefore you must be eligible to receive this and happy to be put through(With a British Citizen or to have lived in the UK for the past 5 years) We are unable to provide work visa sponsorship for this opportunity
-
- Senior Business Analyst - Outside IR35 Contract, SC Clearance Required, London
- London
- £400 per day outside IR35
-
Senior Business Analyst - Outside IR35 Contract, SC Clearance Required, Based in London Project- to engage with colleagues and stakeholders to investigate and model business functions, processes, information flows and data structures, using a range of business analysis techniques. • You will translate the solution to the business problem into detailed requirements by creating user stories and well-defined acceptance criteria. • Elicit end-to-end business requirements for a live cross-government service • Working across the Government departments to bring together varied business and operational outcomes to form a holistic overall set of service requirements Current SC clearance is required. As is the ability to travel to London.
-
- DV cleared CCP Senior IA Architect Contract. 12 month Outside IR35
- N/A
- 600 per day Outside IR35
-
DV cleared CCP Senior IA Architect Contract. 12 month Outside IR35. £600 MOD experience (Secure by Design, Accreditation, management) / CADMID project life cycle. Working within and across programmes across Land, Air and Fleet. Meng / Ceng. Ability to travel where as and where needed across the M3 / M4 corridor
-
- Illumio Engineer - CONTRACT. EUROPE
- Sweden
- N/A
-
Engineer with hands on Illumio needed for 6 month contract. Ideally based in Sweden, but would consider the right individual to deliver a hybrid role (Occasional travel to Sweden will be required). Connecting services in Illumio, rollout of the agents (VEN). Experience with Illumio Core, endpoint, cloudsecure Looking to start ASAP