Wed 15 May 2019:
WASHINGTON (Reuters) – WhatsApp said on Tuesday that a security breach on its messaging app had signs of coming from a government using surveillance technology developed by a private company, and it may have targeted human rights groups.
WhatsApp, a unit of Facebook, said it had notified the U.S. Department of Justice to help with an investigation, and it encouraged all WhatsApp users to update to the latest version of the app, where the breach had been fixed. WhatsApp, one of the world’s most popular messaging tools, is used by 1.5 billion people monthly. It has touted its high level of security and privacy, with messages on its platform being encrypted end-to-end so that WhatsApp and third parties cannot read or listen to them. The company said it was still investigating the breach but believed only a “select number of users were targeted through this vulnerability by an advanced cyber actor.”
WhatsApp urges users to upgrade app after Israeli spyware attack
WhatsApp said its advice to all users to update came “out of an abundance of caution” and a recommendation by Citizen Lab, a research group at the University of Toronto that it notified about the vulnerability before the announcement. It did not disclose how many users were affected. A technical advisory published on Facebook’s security website said the vulnerability affected both Android and iPhones. A WhatsApp spokesman said the attack was sophisticated and had all the hallmarks of a “private company working with governments on surveillance.” The FBI and Justice Department declined to comment.
HUMAN RIGHTS LAWYER A TARGET
The Financial Times initially reported on the WhatsApp vulnerability that allowed attackers to inject spyware on phones via the app’s voice-calling function. WhatsApp told human rights groups it believed the spyware was developed by Israeli cyber surveillance company NSO Group, best known for its mobile hacking tools, said Eva Galperin, the director of cybersecurity at the Electronic Frontier Foundation, a San Francisco-based nonprofit. “They said they believed it was NSO Group, but they also couched it in very careful terms with many caveats, because attribution is hard,” she said. Like Citizen Lab, EFF was among the groups WhatsApp notified several days ago about the vulnerability. A second person familiar with the matter also identified NSO Group as the suspected culprit.
Israeli Firm Tied to Tool That Uses WhatsApp Flaw to Spy on Activists
HUMAN RIGHTS
WhatsApp said it was “deeply concerned about the abuse” of such surveillance technologies and that it believed human rights activists may have been the targets. “We’re working with human rights groups on learning as much as we can about who may have been impacted from their community. That’s really where our highest concern is,” the spokesman said. Citizen Lab tweeted on Monday: “We believe an attacker tried (and was blocked by WhatsApp) to exploit it as recently as yesterday to target a human rights lawyer.” Citizen Lab told Reuters that the person was the UK lawyer, who had approached Citizen Lab after receiving multiple WhatsApp calls from unknown numbers at strange hours, making him suspicious.
Ireland’s Data Protection Commission (DPC), WhatsApp’s lead regulator in the European Union, said WhatsApp had notified the agency late on Monday of a “serious security vulnerability” on its platform. “The DPC understands that the vulnerability may have enabled a malicious actor to install unauthorized software and gain access to personal data on devices which have WhatsApp installed,” the regulator said in a statement. Cyber security experts said the vast majority of WhatsApp users were unlikely to have been affected.
Think your friends would be interested? Share this story!
