WhatsApp Rushes to Fix Security Flaw Exposed in Hacking of Lawyer’s Phone

An Israeli firm accused of supplying tools for spying on human-rights activists and journalists now faces claims that its technology can use a security hole in WhatsApp, the messaging app used by 1.5 billion people, to break into the digital communications of iPhone and Android phone users.

Security researchers said they had found so-called spyware — designed to take advantage of the WhatsApp flaw — that bears the characteristics of technology from the company, the NSO Group.

WhatsApp engineers worked around the clock to patch the vulnerability and released a patch on Monday. They encouraged customers to update their apps as quickly as possible.

“WhatsApp encourages people to upgrade to the latest version of our app, as well as keep their mobile operating system up to date, to protect against potential targeted exploits designed to compromise information stored on mobile devices,” the Facebook-owned company said in a statement.

The WhatsApp hole was used to target a London lawyer who has been involved in lawsuits that accuse NSO Group of providing tools to hack the phones of Omar Abdulaziz, a Saudi dissident in Canada; a Qatari citizen; and a group of Mexican journalists and activists, the researchers said. The researchers believe the list of targets could be much longer.

Digital attackers could use the vulnerability to insert malicious code and steal data from an Android phone or an iPhone simply by placing a WhatsApp call, even if the victim did not pick up the call. As WhatsApp’s engineers examined the vulnerability, they concluded that it was similar to other tools from the NSO Group, because of its digital footprint.

The lawyer, who spoke on the condition of anonymity because he feared retribution, said he had grown suspicious that his phone had been hacked when he started missing WhatsApp video calls from Swedish telephone numbers at odd hours. The lawyer contacted Citizen Lab at the Munk School of Global Affairs at the University of Toronto, which has helped uncover the use of NSO Group products in attacks on journalists, dissidents and activists.

Ten days ago, as Citizen Lab was looking into the incident, engineers at WhatsApp discovered what they described as abnormal voice calling activity on their systems, said a WhatsApp employee familiar with the investigation, who spoke on the condition of anonymity because the investigation was continuing.

WhatsApp alerted human-rights organizations about the threat and learned from Citizen Lab that the vulnerability had been used to target the lawyer.

WhatsApp said it had alerted the Justice Department to the attack. The WhatsApp flaw was first reported Monday by The Financial Times.

The products of the NSO Group, which operated in secret for years, were found in 2016 as part of a spying campaign on the iPhone of a now-jailed human-rights activist in the United Arab Emirates through undisclosed Apple security vulnerabilities. Since then, the NSO Group’s spyware has been found on the iPhones of journalists, dissidents and even nutritionists.

The company has long advertised that its products are sold to government agencies solely for fighting terrorism and aiding law enforcement investigations.

The NSO Group said in a statement on Monday that its spyware was strictly licensed to government agencies and that it would investigate any “credible allegations of misuse.” The company said it would not be involved in identifying a target for its technology, including the lawyer at the center of the latest accusations.

NSO’s response is consistent with previous responses from the Israeli firm, which claims to have an in-house ethics committee that decides whether or not to sell to countries based on their human-rights records.

But increasingly, NSO’s spyware has been discovered in use by governments with questionable human-rights records like the United Arab Emirates, Saudi Arabia and Mexico.

The Israeli company sold a stake to Novalpina, a British private equity firm, in a leveraged buyout deal last year that valued it at nearly $1 billion.

The firm has been on a public-relations campaign in recent months to show its value to law enforcement, and has cited several examples of its spyware’s being used, it says, to capture drug kingpins and to stop terrorist attacks.

“NSO and Novalpina have spent several months telling the world that there are adults in the room and telegraphing that they have made a commitment to close oversight,” said John Scott-Railton, a senior researcher at Citizen Lab. “Yet even 24 hours ago, we observed what some believe to be an NSO infection attempt against a human-rights lawyer.

“As this case makes it very clear — if indeed this was NSO — there is still a very serious abuse problem,” Mr. Scott-Railton added.Correction: May 14, 2019

An earlier version of this article misidentified the country from which a lawyer received telephone calls at odd hours. It was Sweden, not Norway.

Photo: NSO Group headquarters in Herzliya, Israel. One of the firm’s spyware tools was used to break into cellphones through a WhatsApp security flaw, researchers said.Credit...Jack Guez/Agence France-Presse — Getty Images

Link: https://www.nytimes.com/2019/05/13/technology/nso-group-whatsapp-spying.html