WhatsApp was used to inject spyware on users’ phones

Facebook might be facing another scandal soon as WhatsApp, a messaging application owned by the company, was used to inject Israeli spyware on to phones. WhatsApp is one of the most popular messaging application with 1.5 billion users around the world. However, as it turns out, it is not immune to attackers. The application has a vulnerability, which was exploited to distribute malicious code to phones. As the company reports, the surveillance software was installed on iPhones and Androids by calling the targets using the WhatsApp phone call function. Even if the target didn’t answer the call, the spyware was injected on to the phone. Sometimes the calls would disappear from the history and the user wouldn’t even find out about the suspicious activity.

The spyware was developed by an Israeli company called NSO Group. NSO Group has developed Pegasus, a program that can turn on the camera and microphone on phones without user’s consent. It can also collect data from emails, messages and user location. NSO markets its products to governments and packages it as a tool for targeting terrorism. The company is valued at $1 billion.

WhatsApp responds to the breach

Immediately after the news broke out, the WhatsApp team started to work on the breach and the company said it has already fixed the problem.  Users should update their applications to make sure they won’t be targeted by the malware in the future.  “This attack has all the hallmarks of a private company known to work with governments to deliver spyware that reportedly takes over the functions of mobile phone operating systems. We have briefed a number of human rights organizations to share the information we can, and to work with them to notify civil society,” – WhatsApp said.

NSO is investigating the attack as well. The company has denied the claims that it was in any way involved with the incident. “Under no circumstances would NSO be involved in the operating or identifying of targets of its technology, which is solely operated by intelligence and law enforcement agencies. NSO would not, or could not, use its technology in its own right to target any person or organization, including this individual ,” – NSO commented.

The UK lawyer mentioned above has helped various individuals sue NSO for the abuse of the software created by the company by the clients. “We had a strong suspicion that the person’s phone was being targeted, so we observed the suspected attack, and confirmed that it did not result in infection. We believe that the measures that WhatsApp put in place in the last several days prevented the attacks from being successful,” – said John Scott-Railton, a researcher at Citizen Lab.

Alaa Mahajne, a lawyer who is involved in the lawsuits against NSO said his team was also targeted by the malware. “It’s upsetting but not surprising that my team has been targeted with the very technology that we are raising concerns about in our lawsuits. This desperate reaction to hamper our work and silence us itself shows how urgent the lawsuits are, as we can see that the abuses are continuing,” – Alaa commented.