WhatsApp admitted a major cybersecurity breach that has enabled targeted spyware to be installed on phones through voice calls. The security vulnerability affects both iPhone and Android devices, with malicious code (allegedly) from Israel’s NSO Group, transmitted whether or not a user answers an infected call.
Facebook has suffered a multitude of security and privacy breaches in the last year, but this news that a government-grade intelligence collection application had targeted the company’s WhatsApp application is different. WhatsApp is Facebook’s flagship messaging application and is lauded for its end-to-end encryption, both for messaging and voice calls. As a result, it has become a standard communications platform for government and security officials in many countries around the world.
WhatsApp engineers had been working round the clock to close the security loophole that was discovered early this month, and the company started to deploy a fix to servers on Friday and to customers on Monday. According to the Financial Times, a WhatsApp spokesperson said “a number in the dozens would not be inaccurate” in terms of impacted users.
The WhatsApp vulnerability is a buffer overflow weakness, enabling malicious code to be inserted into data packets sent during the process of starting a voice call. When the data is received, WhatsApp’s internal buffer is forced to overflow, overwriting other parts of the app’s memory, and control is given over to the application.
A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of SRTCP packets sent to a target phone number. The issue affects WhatsApp for Android prior to v2.19.134, WhatsApp Business for Android prior to v2.19.44, WhatsApp for iOS prior to v2.19.51, WhatsApp Business for iOS prior to v2.19.51, WhatsApp for Windows Phone prior to v2.18.348, and WhatsApp for Tizen prior to v2.18.15.”
Ironically, on Monday Amnesty International said that it was “supporting legal action to take the Israeli Ministry of Defence (MoD) to court, to demand that it revokes the export license of NSO Group, an Israeli company whose spyware products have been used in chilling attacks on human rights defenders around the world. In a petition to be filed tomorrow at the District Court of Tel Aviv, approximately 30 members and supporters of Amnesty International Israel and others from the human rights community set out how the MoD has put human rights at risk by allowing NSO to continue.