WhatsApp discovers ‘targeted’ surveillance attack

Hackers were able to remotely install surveillance software on phones and other devices using a major vulnerability in messaging app WhatsApp, it has been confirmed.

WhatsApp, which is owned by Facebook, said the attack targeted a “select number” of users, and was orchestrated by “an advanced cyber actor”.

A fix was rolled out on Friday.

The attack was developed by Israeli security firm NSO Group, according to a report in the Financial Times.

On Monday, WhatsApp urged all of its 1.5 billion users to update their apps as an added precaution.

The attack was first discovered earlier this month.

WhatsApp promotes itself as a “secure” communications app because messages are end-to-end encrypted, meaning they should only be displayed in a legible form on the sender or recipient’s device.

However, the surveillance software would have let an attacker read the messages on the target’s device.

“Journalists, lawyers, activists and human rights defenders” are most likely to have been targeted, said Ahmed Zidan from the non-profit Committee to Protect Journalists.
How do I update WhatsApp?
Android

Open the Google Play store
Tap the menu at the top left of the screen
Tap My Apps & Games
If WhatsApp has recently been updated, it will appear in the list of apps with a button that says Open
If WhatsApp has not been automatically updated, the button will say Update. Tap Update to install the new version
The latest version of WhatsApp on Android is 2.19.134
iOS

Open the App Store
At the bottom of the screen, tap Updates
If WhatsApp has recently been updated, it will appear in the list of apps with a button that says Open
If WhatsApp has not been automatically updated, the button will say Update. Tap Update to install the new version
The latest version of WhatsApp on iOS is 2.19.51
How was the security flaw used?
It involved attackers using WhatsApp’s voice calling function to ring a target’s device. Even if the call was not picked up, the surveillance software would be installed, and, the FT reported, the call would often disappear from the device’s call log.

WhatsApp told the BBC its security team was the first to identify the flaw, and shared that information with human rights groups, selected security vendors and the US Department of Justice earlier this month.

“The attack has all the hallmarks of a private company reportedly that works with governments to deliver spyware that takes over the functions of mobile phone operating systems,” the company said on Monday in a briefing document note for journalists.

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.