WhatsApp vulnerability allowed secretive installation of spyware

mood · May 13, 2019

WhatsApp vulnerability allowed secretive installation of spyware
Messaging app feature was used to install malicious code made by an Israeli company, the Financial Times reports
May 13, 2019
https://www.cnet.com/news/whatsapp-vulnerability-reportedly-allowed-spyware-attack/

A vulnerability in messaging app WhatsApp allowed attackers to install Israeli spyware onto phones, the Financial Times reported Monday.

"This attack has all the hallmarks of a private company known to work with governments to deliver spyware that reportedly takes over the functions of mobile phone operating systems," the company told the Financial Times.
WhatsApp engineers were working to close the vulnerability Sunday night and issued a patch for customers on Monday, the Financial Times reported.

The Facebook-owned service, which has about 1.5 billion users, reportedly doesn't know how many phones may have been infected with the spyware.
Click to expand...

TechCrunch: WhatsApp exploit let attackers install government-grade spyware on phones

The vulnerability (documented here) was discovered by the Facebook-owned WhatsApp in early May, the company confirmed to TechCrunch. It apparently leveraged a bug in the audio call feature of the app to allow the caller to allow the installation of spyware on the device being called, whether the call was answered or not.

Naturally when a security-focused app like WhatsApp finds that a private company has, potentially at least, been secretly selling a known and dangerous exploit of its protocols, there’s a certain amount of enmity. But it’s all part of the 0-day game, an arms race to protect against or breach the latest security measures.
Click to expand...

ronjor · May 14, 2019

9 things you need to know about the WhatsApp spyware attack

By Michael Grothaus 05.14.19
Facebook-owned WhatsApp is urging all of its users worldwide to update the app to the latest version of the software after it discovered that the app’s integrity had been compromised. The warning came after the Financial Times revealed that a vulnerability had been discovered that let attackers install spyware on iPhones and Android phones simply by placing a WhatsApp voice call to the user’s smartphone. Here are nine things you need to know about the attack:
Click to expand...

ronjor · May 14, 2019

WhatsApp to refer security breach to U.S. authorities

Steven Scheer May 14, 2019
JERUSALEM (Reuters) - Facebook’s WhatsApp said on Tuesday a security breach on its messaging app had signs of coming from a private company working on surveillance and it had referred the incident to the U.S. Department of Justice.
Click to expand...

mood · May 15, 2019

It’s Almost Impossible to Tell if Your iPhone Has Been Hacked
May 14, 2019
https://www.vice.com/en_us/article/pajkkz/its-almost-impossible-to-tell-if-iphone-has-been-hacked

Hackers have been breaking into iPhones allegedly using a powerful spy tool sold to governments and taking advantage of a previously unknown vulnerability in the popular messaging app WhatsApp.

“The simple reality is there are so many 0-day exploits for iOS,” Stefan Esser, a security researcher that specializes in iOS, wrote on Twitter. “And the only reason why just a few attacks have been caught in the wild is that iOS phones by design hinder defenders to inspect the phones.”
As of today, there is no specific tool that an iPhone user can download to analyze their phone and figure out if it has been compromised.
Moreover, iOS is so locked down that without hacking or jailbreaking it first, even a talented security researcher can do very little analysis on it.

“These security controls have made mobile devices extremely difficult to inspect, especially remotely, and particularly for those of us working in human rights organizations lacking access to adequate forensics technology. [...]" Guarnieri wrote in a mailing list message.
Click to expand...

On the WhatsApp 0day and legal action against NSO Group

[...] Last August, for example, we discovered one of our Amnesty staff members was targeted with Pegasus4 but whether others were too is not possible for us to confirm. Quite frankly, we are on the losing side of a disheartening asymmetry of capabilities that favors attackers over us, defenders.

The darker reality is that NSO Group is just one of many, many more surveillance firms operating in the same space. NSO is getting caught in public more regularly probably because of their larger market share, but also because there is existing documentation for security researchers out there, such as those at Facebook who discovered this WhatsApp exploit, who can at least marginally follow NSO Group’s breadcrumbs. [...]
Click to expand...

mood · May 17, 2019

“WhatsApp Will Never Be Secure” – Telegram Founder Attack Facebook Owned WhatsApp
May 17, 2019
https://gbhackers.com/whatsapp-will-never-be-secure/

Unlike Telegram, WhatsApp is not an open source platform and it never allows security researchers to check whether the App contain any malicious code or stealing any data from users.
WhatsApp built with extremely obfuscated functionality in their app binaries to make sure no one able to read the code and study their infrastructure clearly.

Durov pointed similar incidents (1, 2, 3) and said “Every time WhatsApp has to fix a critical vulnerability in their app, a new one seems to appear in its place. All of their security issues are conveniently suitable for surveillance, and look and work a lot like backdoors.”

”WhatsApp has a consistent history – from zero encryption at its inception to a succession of security issues strangely suitable for surveillance purposes. Looking back, there hasn’t been a single day in WhatsApp’s 10-year journey when this service was secure [...]”
Click to expand...

He Wrote a brief Statement in Telegraph “A lot of people can’t stop using WhatsApp, because their friends and family are still on it. [...] The majority of internet users are still held hostage by the Facebook/WhatsApp/Instagram empire. Many of those who use Telegram are also on WhatsApp, meaning their phones are still vulnerable.”
"[...] we disclosed exactly zero bytes of data to third-parties, while Facebook/WhatsApp has been sharing pretty much everything with everybody who claimed they worked for a government “
Click to expand...

Minimalist · May 17, 2019

Most WhatsApp Users Have Still Not Patched

Mobile security specialist Wandera has warned that most people have still not patched a serious WhatsApp vulnerability.

Indeed, the London-based company said that according to its data, a huge number of Apple users have yet to upgrade their version of WhatsApp. Android users have apparently responded quicker, but a majority of them are still running the unpatched WhatsApp version.
Click to expand...

https://www.silicon.co.uk/mobility/mobile-apps/most-whatsapp-not-patched-255099

Rasheed187 · May 18, 2019

mood said: ↑

It’s Almost Impossible to Tell if Your iPhone Has Been Hacked
May 14, 2019
https://www.vice.com/en_us/article/pajkkz/its-almost-impossible-to-tell-if-iphone-has-been-hacked
Click to expand...

What the hell, seems like quite a serious bug. And this confirms that smartphones are insecure devices.

Beyonder · May 19, 2019

mood said: ↑

“WhatsApp Will Never Be Secure” – Telegram Founder Attack Facebook Owned WhatsApp
May 17, 2019
https://gbhackers.com/whatsapp-will-never-be-secure/
Click to expand...

A good laugh, that guy. Seems really legit that he complains about WhatsApp being closed source when the server code for Telegram is also closed source.

BoerenkoolMetWorst · May 20, 2019

Beyonder said: ↑

A good laugh, that guy. Seems really legit that he complains about WhatsApp being closed source when the server code for Telegram is also closed source.
Click to expand...

Also really legit that he complains about WhatsApp not being secure when Telegram doesn't even use end-to-end encryption by default..

mood · Oct 29, 2019

Facebook sues Israel's NSO Group over alleged WhatsApp hack
October 28, 2019
https://www.reuters.com/article/us-...roup-over-alleged-whatsapp-hack-idUSKBN1X82BE

Facebook Inc on Tuesday sued Israeli cyber surveillance firm NSO Group, alleging it hacked users of messaging platform WhatsApp earlier this year.

The hacking spree targeted journalists, diplomats, human rights activists, senior government officials and others, Facebook said in its lawsuit, filed in U.S. District Court in San Francisco.
Facebook is seeking to have NSO barred from accessing or attempting to access WhatsApp and Facebook’s services and is seeking unspecified damages.
Click to expand...

The New York Times: WhatsApp Says Israeli Firm Used Its App in Spy Program

In its lawsuit, WhatsApp said that between April and May 2019, it discovered NSO Group tools were used to hijack the phones of its users. WhatsApp said that based on the country codes of the numbers targeted, NSO Group’s tools were used to hack the phones of people in Bahrain, the United Arab Emirates and Mexico.

The suit was filed in the United States District Court in the Northern District of California. NSO Group did not immediately respond to request for comment.
WhatsApp said in a statement that it was informing affected customers with special WhatsApp messages. The company is seeking a permanent injunction banning NSO from its service, and called on lawmakers to ban the use of cyberweapons like those sold by NSO Group to governments all over the world.
Click to expand...

ronjor · Oct 29, 2019

Why WhatsApp is pushing back on NSO Group hacking

By Will Cathcart Oct. 29, 2019
Will Cathcart is head of WhatsApp, which is owned by Facebook.
In May, WhatsApp announced that we had detected and blocked a new kind of cyberattack involving a vulnerability in our video-calling feature. A user would receive what appeared to be a video call, but this was not a normal call. After the phone rang, the attacker secretly transmitted malicious code in an effort to infect the victim’s phone with spyware. The person did not even have to answer the call.
Click to expand...

mood · Nov 6, 2019

Malware attack on users: CERT-In alerted three days before WhatsApp pinged
November 6, 2019
https://economictimes.indiatimes.co...fore-whatsapp-pinged/articleshow/71931668.cms

Indian Computer Emergency Response Team (CERT-In) had published an advisory on the malware attack on WhatsApp users three days before the Facebook-owned instant messaging platform first alerted the Indian government, a top official told ET.

The alert by WhatsApp, delivered to the agency later in May, did not have any mention that the malware used in the attack was Pegasus, developed by Israeli surveillance firm NSO Group, the source said.
Ambiguous Response
WhatsApp had also informed the Indian government that it had fixed the vulnerability and was ambiguous about whether the attack actually happened or not. “They (WhatsApp) did not mention at all that those targeted may still be under attack,” the official said.
The ministry of electronics and IT (Meity) and WhatsApp are currently engaged in a war of words with the government accusing the company of not disclosing the seriousness of the snooping attack

“(The company) knew who was being impacted and had started sending individual messages to them, why did it not share those details with the (Indian) government,” the person said.
However, WhatsApp is silent about when it first alerted CERT In.
Click to expand...

mood · Nov 16, 2019

WhatsApp flaw CVE-2019-11931 could be exploited to install spyware
The popular messaging platform WhatsApp made the headlines again
November 16, 2019
https://securityaffairs.co/wordpress/93932/hacking/whatsapp-flaw-cve-2019-11931.html

According to the website The Hacker News, WhatsApp has recently fixed a critical vulnerability, tracked as CVE-2019-11931, that could have allowed attackers to remotely compromise targeted devices.
The CVE-2019-11931 is a stack-based buffer overflow issue that affects the way WhatsApp handles the elementary stream metadata of an MP4 file.

“A stack-based buffer overflow could be triggered in WhatsApp by sending a specially crafted MP4 file to a WhatsApp user. The issue was present in parsing the elementary stream metadata of an MP4 file and could result in a DoS or RCE.” reads an advisory published by Facebook.
The issue could trigger a DoS condition or it could exploit by a remote attacker to execute arbitrary code on the target devices.

“Android versions prior to 2.19.274, iOS versions prior to 2.19.100, Enterprise Client versions prior to 2.25.3, Windows Phone versions before and including 2.18.368, Business for Android versions prior to 2.19.104, and Business for iOS versions prior to 2.19.100.” continues the security advisory.
Click to expand...

The Hacker News: New WhatsApp Bug Could Have Let Hackers Secretly Install Spyware On Your Devices

mood · Nov 26, 2019

Facebook countersued by NSO Group, Israeli spyware vendor
November 26, 2019
https://www.washingtontimes.com/news/2019/nov/26/facebook-countersued-by-nso-group-israeli-spyware-/

Facebook was sued Tuesday by several employees of NSO Group, an Israel cybersecurity firm on the opposite end of a civil suit brought by the social networking company last month.

In the latest lawsuit, past and present NSO Group employees allege that their personal accounts on both Facebook and its sister service Instagram were abruptly disabled without prior notice recently over their connection to the Israeli company — “collective punishment” according to the plaintiffs’ lawyers.

“Facebook decided, barbarously and unilaterally, to block the applicants’ private accounts, just because the company they work or previously worked for was sued by Facebook,” the NSO Group employees’ attorneys said in Hebrew.
The lawsuit also alleges that Facebook violated its own policies and Israel privacy law by seemingly misusing the personal information provided by the defendants in order to identify them as past of present NSO Group employees.
Click to expand...

mood · Nov 29, 2019

India plans security audit of WhatsApp after hacking attempt
November 28, 2019
https://www.reuters.com/article/us-...-whatsapp-after-hacking-attempt-idUSKBN1Y21JX

India wants to conduct an audit of WhatsApp’s security systems following revelations that a spyware exploited vulnerabilities in the Facebook-owned messaging platform, the country’s technology minister said on Thursday.

The Indian Computer Emergency Team (CERT-In) “sought submission of information from WhatsApp on November 9, 2019, including a need to conduct an audit and inspection of WhatsApp’s security systems and processes,” Ravi Shankar Prasad told parliament in a statement.
WhatsApp declined to comment.
Click to expand...

mood · Dec 21, 2019

Report: Israeli Spyware Allegedly Used to Target Pakistani Officials' Phones
December 21, 2019
https://en.farsnews.com/newstext.aspx?nn=13980930000856

The alleged targeting was discovered during an analysis of 1,400 people whose phones were the focus of hacking attempts in a two-week period earlier this year, according to the sources.
All the suspected intrusions exploited a vulnerability in WhatsApp software that potentially allowed the users of the malware to access messages and data on the targets’ phones.

The alleged targeting of Pakistani officials gives a first insight into how NSO’s signature “Pegasus” spyware could have been used for “state-on-state” espionage.
Government officials in Pakistan’s ministry of information technology have also reportedly advised officials to stop sharing classified information over WhatsApp and replace smartphones that were purchased before May 2019, according to local press reports.

NSO has not commented on whether it has pursued any internal investigations into the alleged WhatsApp hack.
Click to expand...

mood · Jan 4, 2020

The alleged targeting was discovered during an analysis of 1,400 people whose phones were the focus of hacking attempts
Click to expand...

Police Tracked a Terror Suspect — Until His Phone Went Dark After a Facebook Warning
January 2, 2020
https://www.morningstar.com/news/do...-his-phone-went-dark-after-a-facebook-warning

WhatsApp, Facebook Inc.'s popular messaging tool, had just notified about 1,400 users -- among them the suspected terrorist -- that their phones had been hacked by an "advanced cyber actor." An elite surveillance team was using spyware from NSO Group, an Israeli company, to track the suspect, according to a law-enforcement official overseeing the investigation.

WhatsApp was notifying suspects whom his team was tracking that their phones had been hacked. "No, that can't be right. Why would they do that?" the official said he asked his contact, thinking it a joke.
"We only had that one phone," the official said.
The interception of data from the suspect's phone had gone on for just a few days before WhatsApp alerted the target.

In a move highlighting the complex legal landscape tech companies and law enforcement must navigate in Europe, new European Union rules kicking in by the end of 2020 will oblige telecommunications companies, including Facebook, Google and Skype, to warn customers about security threats precisely the way WhatsApp notified its users in October.
Click to expand...

Beyonder · Jan 4, 2020

mood said: ↑

Police Tracked a Terror Suspect — Until His Phone Went Dark After a Facebook Warning
January 2, 2020
https://www.morningstar.com/news/do...-his-phone-went-dark-after-a-facebook-warning
Click to expand...

It's almost like they should find other ways of tracking him, without using his cellphone. If he reinstalled it and the malware went away, would they complain to Google for allowing that?

mood · Jan 30, 2020

FBI probing Israeli firm NSO over phone hacking suspicions — report
January 30, 2020
https://www.timesofisrael.com/fbi-probing-israeli-firm-nso-over-phone-hacking-suspicions-report/

The FBI is investigating Israeli spyware firm NSO over suspicions it’s products were used to hack American citizens’ phones and spy on foreign governments, according to a Reuters report early Friday.

Sources familiar with the investigation said the probe is attempting to look at whether NSO products were being used to gain access to phones belonging to Americans and whether any foreign nations were using tools to spy on US government officials of those of allies. the news agency reported.
The investigation, which may not be solely focused on NSO, has been ongoing since 2017, according to Reuters.
Click to expand...

Reuters: Exclusive: FBI probes use of Israeli firm's spyware in personal and government hacks - sources

The FBI conducted more interviews with technology industry experts after Facebook filed a lawsuit in October accusing NSO itself of exploiting a flaw in Facebook’s WhatsApp messaging service to hack 1,400 users, according to two people who spoke with agents or Justice Department officials.

NSO said it was not aware of any inquiry.

“We have not been contacted by any U.S. law enforcement at all about any such matters,” NSO said in a statement provided by Mercury Public Affairs strategy firm.
A spokeswoman for the FBI said the agency “adheres to DOJ’s policy of neither confirming nor denying the existence of any investigation, so we wouldn’t be able to provide any further comment.”
Click to expand...

mood · Feb 18, 2020

mood said: ↑

Facebook countersued by NSO Group, Israeli spyware vendor
November 26, 2019
https://www.washingtontimes.com/news/2019/nov/26/facebook-countersued-by-nso-group-israeli-spyware-/
Click to expand...

Facebook must unblock NSO Group employee’s account, Israeli court rules
February 18, 2020
https://www.cyberscoop.com/israel-court-facebook-nso/

An Israeli court has ordered Facebook to unblock the account of an employee of NSO Group after a complaint from the software surveillance vendor, according to officials at both companies.

In a lawsuit last year, Facebook accused NSO Group, through its custom malware, of being complicit in a hack last of 1,400 mobile devices running WhatsApp, the Facebook-owned messaging platform. NSO Group employees had filed a petition in November asking an Israeli court to lift a block that Facebook had placed on their accounts.

A Facebook spokesperson said Tuesday the company “will continue to take appropriate action to defend our users and we look forward to participating in open court to document how NSO threatens the safety and security of users and needs to be held accountable.”
Click to expand...

mood · Mar 3, 2020

Facebook Wins Malware Suit After NSO’s No-Show in Court
March 3, 2020
https://www.bnnbloomberg.ca/facebook-wins-malware-suit-after-nso-s-no-show-in-court-1.1399682

Facebook Inc. prevailed in a lawsuit accusing NSO Group of exploiting WhatsApp services for mass surveillance after the Israeli spyware manufacturer didn’t show up in U.S. court to contest the allegations.

A default judgment was entered Monday in San Francisco federal court after Facebook told a judge that it made ample efforts -- all unanswered -- to give NSO Group notice of the suit and a chance to respond.
Facebook alleged in October that NSO Group created WhatsApp accounts that it used to send malware and hack into the mobile phones of 1,400 people.
A WhatsApp spokesperson said NSO has chosen not to defend its actions in court.

“NSO Group conducted cyber attacks against WhatsApp and its users, including human rights activists, journalists, and diplomats, in violation of U.S. law,” the spokesperson said in a statement.
Click to expand...

mood · Mar 11, 2020

NSO Group hits back at Facebook in snooping case
March 11, 2020
https://www.hindustantimes.com/tech...ooping-case/story-6P5PD1lsmwnCFgz7i0sK6O.html

An Israeli spyware maker is asking a judge to sanction Facebook Inc. for allegedly skirting international law and lying about it to a judge to gain advantage in a lawsuit.

NSO Group claims Facebook failed to properly provide notice under the rules of the Hague Convention when it sued NSO Group in October, accusing the company of creating bogus WhatsApp accounts to send malware and hack into the phones of 1,400 people.
Based on Facebook’s claim that NSO Group failed to respond to the complaint, a court clerk entered a default against the Israeli company last week in federal court in San Francisco.

Facebook isn’t contesting the request to remove the default, but is asking the judge to move the case along on the merits without further delay.
Click to expand...

mood · Apr 24, 2020

Facebook-NSO lawsuit: Hundreds of WhatsApp attacks linked to one IP address
Facebook fights to keep the lawsuit on track
April 24, 2020
https://www.zdnet.com/article/nso-l...ndreds-of-whatsapp-attacks-to-one-ip-address/

The legal case between Facebook and Israeli spyware vendor NSO Group is starting to yield the details tech and cyber-security experts have been waiting since Facebook filed its lawsuit in October 2019.

In court documents filed yesterday, Facebook said it linked 720 instances of attacks against WhatsApp users to one single IP address.
The attacks were carried out against WhatsApp users in the spring of 2019. The exploit used in the attack was a zero-day in the WhatsApp VoIP feature.

The exploit had the ability to infect a phone with the Pegasus malware, which then pinged NSO command and control servers for instructions on what commands to execute and what data to steal.
Click to expand...

HUNDREDS OF ATTACKS LINKED TO ONE US SERVER
"I have reviewed the malicious code sent during the attack described in the Complaint," said Claudiu Gheorghe, a software engineering manager for WhatsApp in court documents filed by Facebook's legal team last night.
The first of these IPs, and the one most commonly observed by WhatsApp engineers, belongs to QuadraNet Enterprises LLC, a Los Angeles-based data center provider.
The small detail to what IP address a hacked WhatsApp user has communicated is now crucial in the case after earlier this month [...]
FACEBOOK NSO IS NOT IMMUNE BECAUSE IT SELLS TO GOVERNMENTS
In its 35-page document, Facebook also brought counter-arguments to all the items raised by NSO's motion to dismiss the case earlier this month. [...]
Click to expand...

Minimalist · May 22, 2020

NSO Group Impersonates Facebook Security Team to Spread Spyware — Report

According to an investigative journalist team, the Israeli authors of the infamous Pegasus mobile spyware, NSO Group, have been using a spoofed Facebook login page, crafted to look like an internal Facebook security team portal, to lure victims in.
Click to expand...

https://threatpost.com/nso-group-impersonates-facebook-security/

Dermot7 · Jun 8, 2020

TEL AVIV (Reuters) - Israel’s NSO Group showcased a new anti-drone defence on Monday, giving the public a rare look at its technology as it seeks to counter allegations that another of its products has aided privacy breaches and political surveillance.
Click to expand...

https://www.reuters.com/article/us-...ounter-rights-abuse-allegations-idUSKBN23F2FX

Log in or Sign up

WhatsApp vulnerability allowed secretive installation of spyware

mood Updates Team

ronjor Global Moderator

ronjor Global Moderator

mood Updates Team

mood Updates Team

Minimalist Registered Member

Rasheed187 Registered Member

Beyonder Registered Member

BoerenkoolMetWorst Registered Member

mood Updates Team

ronjor Global Moderator

mood Updates Team

mood Updates Team

mood Updates Team

mood Updates Team

mood Updates Team

mood Updates Team

Beyonder Registered Member

mood Updates Team

mood Updates Team

mood Updates Team

mood Updates Team

mood Updates Team

Minimalist Registered Member

Dermot7 Registered Member

Log in or Sign up

WhatsApp vulnerability allowed secretive installation of spyware

mood Updates Team

ronjor Global Moderator

ronjor Global Moderator

mood Updates Team

mood Updates Team

Minimalist Registered Member

Rasheed187 Registered Member

Beyonder Registered Member

BoerenkoolMetWorst Registered Member

mood Updates Team

ronjor Global Moderator

mood Updates Team

mood Updates Team

mood Updates Team

mood Updates Team

mood Updates Team

mood Updates Team

Beyonder Registered Member

mood Updates Team

mood Updates Team

mood Updates Team

mood Updates Team

mood Updates Team

Minimalist Registered Member

Dermot7 Registered Member

Useful Searches