As if Facebook doesn’t already have its plate full, spyware is attacking one of its companies, WhatsApp, with government-grade technology to retrieve user information amidst on-going issues regarding privacy concerns.
WhatsApp is supposedly Facebook’s more secure version of online chatting. The company boasts the end-to-end encryption technology that sets it apart from other companies under Facebook. In other terms, its feature where WhatsApp requires a password of some sort from both ends of a conversation and that accounts are directly connected with users’ respective mobile numbers makes it virtually impossible for company servers to snoop around conversations. It is also reported earlier this year that Facebook plans to implement the same set of privacy features to its other apps like Messenger and Instagram to address concerns regarding privacy concerns.
However, a serious security hole was discovered earlier this month that allowed a bug to breach WhatsApp as first reported by The Financial Times.
Once the bug was injected through the security hole in WhatsApp’s system, it gives the caller leverage to make a phone call that would enable the bug to install commercial-grade spyware that would allow the caller access to the user’s personal information. To make things worse the action can be done even if the call was answered or not.
To put it into perspective, once a phone has been infected by the spyware-enabling bug, there’s hardly any other choice with preventing hackers from accessing other people’s information. There is also no way to determine who or how many people can be affected by the bug. “The company said that it suspects a relatively small number of users were targeted, since it would be nontrivial to deploy, limiting it to advanced and highly motivated actors,” TechCrunch reports.
In other words, the bug is one ticket ride to retrieve a WhatsApp user’s personal information stored within the application. As of the moment, what information WhatsApp stores is completely up for speculation since Facebook haven’t disclosed information regarding that yet.
Fortunately for WhatsApp users, once the company was alerted about the serious matter, they were able to address the issue and work on a preventive method within its infrastructure that would basically ban the bug from entering their system. Reportedly, WhatsApp was able to make the counteraction in less than 10 days of being aware of the problem. However, it is not indicated that the prevention feature would help users who are already affected and whether or not their information can be retrieved from hackers.
The feature is available today by downloading the latest WhatsApp update. “WhatsApp encourages people to upgrade to the latest version of our app, as well as keep their mobile operating system up to date, to protect against potential targeted exploits designed to compromise information stored on mobile devices,” the company said in a statement.
The spyware attacking WhatsApp is said to be developed by the Israeli cyber intelligence company NSO Group named Pegasus. NSO is a company that usually sells commercial-grade snooping tech to nation states. However, the company denies having involvement with WhatsApp’s case.
“Under no circumstances would NSO be involved in the operating or identifying of targets of its technology, which is solely operated by intelligence and law enforcement agencies,” NSO Group told the Financial Times. “NSO would not, or could not, use its technology in its own right to target any person or organization, including this individual.”
The Guardian notes that “NSO limits sales of its spyware, Pegasus, to state intelligence agencies. The spyware’s capabilities are near absolute. Once installed on a phone, the software can extract all of the data that’s already on the device (text messages, contacts, GPS location, email, browser history, etc) in addition to creating new data by using the phone’s microphone and camera to record the user’s surroundings and ambient sounds, according to a 2016 report by the New York Times.”
However, FT reports from a different perspective where the spyware was first detected when an attempted attack was done against a UK-based attorney on May 12. The lawyer, who was undisclosed, was involved in a lawsuit against NSO brought by a group of Mexican journalists, government critics, and a Saudi Arabian dissident.
There is nothing concrete as to what or who led the attack on WhatsApp’s operating system as everything are still under investigation.