Popular messaging app, WhatsApp had a vulnerability that allowed attackers to install government-grade spyware. The vulnerability allowed a caller to install the spyware on the device being called regardless of whether or not the call was answered. These calls often disappeared from the call logs.
This loophole exposed civil rights activists to hacking attempts. The spyware is made by Israel based NSO group and is usually licensed to governments to ” prevent and investigate terrorism and crime” although digital privacy and human rights activists say the company is an enabler of repressive regimes who crack down on dissidents, whistleblowers, and journalists. Late last year, Pegasus had been traced in Kenya.
Once installed, Pegasus can gain access to multiple aspects of a users phone as it is able to turn on and collect data from the microphone and camera and also get location logs, emails, and messages.
In a statement, WhatsApp didn’t mention NSO but the suspicions are pretty clear:
“The attack has all the hallmarks of a private company reportedly that works with governments to deliver spyware, ” WhatsApp said. “We have briefed a number of human rights organizations to share the information we can, and to work with them to notify civil society.”
It is not known how many Android phones and iPhones have been affected by this exploit. WhatsApp says that it has already fixed this vulnerability in less than 10 days after it was discovered and believes that only a few of its users we’re targets of the attack.
A UK-based human Rights lawyer’s phone was targetted using this method and the University of Toronto’s Citizen Lab believed that the attack was linked to this security loophole that the Facebook-owned chat app was trying to fix.
In a statement to the Financial Times, Jon Scott-Railton, a researcher at the lab said the attack had failed and believes that the measures WhatsApp ha put in place in the past several days prevented the attack.
On Friday last week, WhatsApp began rolling out a server-side fix and issued an all update to users of the messaging app on Monday. The best thing you can do right now to protect yourself is by installing the latest version of WhatsApp.
NSO is already being sued by Mexican nationals and a Saudi exile arguing that the company is complicit in its client’s abuse of its software. Civil rights activists are already calling on Israeli ministry of defense to revoke NSOs export license. According to the Financial Times, WhatsApp already alerted the US Department of Justice about this attack last week.
