Escort Bodrum Bayan xxx Escort Bayan Bodrum

General News

WhatsApp Discovers Surveillance Attack

By  | 
WhatsApp logo
WhatsApp has 1.5bn users, but it believed the attacks were highly-targeted

Hackers were able to remotely install surveillance software on phones and other devices using a major vulnerability in messaging app WhatsApp, it has been confirmed.

WhatsApp, which is owned by Facebook, said the attack targeted a “select number” of users and was orchestrated by “an advanced cyber-actor”.

A fix was rolled out on Friday.

On Monday, WhatsApp urged all of its 1.5 billion users to update their apps as an added precaution.

The surveillance software involved was developed by Israeli firm NSO Group, according to a report in the Financial Times.

Facebook first discovered the flaw in WhatsApp earlier in May.

WhatsApp promotes itself as a “secure” communications app because messages are end-to-end encrypted, meaning they should only be displayed in a legible form on the sender or recipient’s device.

However, the surveillance software would have let an attacker read the messages on the target’s device.

Some users of the app have questioned why the app store notes associated with the latest update are not explicit about the fix.

“Journalists, lawyers, activists and human rights defenders” are most likely to have been targeted, said Ahmed Zidan from the non-profit Committee to Protect Journalists.

Presentational grey line

How do I update WhatsApp?

Android

  • Open the Google Play store
  • Tap the menu at the top left of the screen
  • Tap My Apps & Games
  • If WhatsApp has recently been updated, it will appear in the list of apps with a button that says Open
  • If WhatsApp has not been automatically updated, the button will say Update. Tap Update to install the new version
  • The latest version of WhatsApp on Android is 2.19.134

iOS

  • Open the App Store
  • At the bottom of the screen, tap Updates
  • If WhatsApp has recently been updated, it will appear in the list of apps with a button that says Open
  • If WhatsApp has not been automatically updated, the button will say Update. Tap Update to install the new version
  • The latest version of WhatsApp on iOS is 2.19.51
Presentational grey line

How was the security flaw used?

It involved attackers using WhatsApp’s voice calling function to ring a target’s device.

Even if the call was not picked up, the surveillance software could be installed. According to the FT report, the call would often disappear from the device’s call log.

WhatsApp told the BBC its security team was the first to identify the flaw. It shared that information with human rights groups, selected security vendors and the US Department of Justice earlier this month.

“The attack has all the hallmarks of a private company reportedly that works with governments to deliver spyware that takes over the functions of mobile phone operating systems,” the company said on Monday in a briefing document note for journalists.

The firm also published an advisory to security specialists, in which it described the flaw as: “A buffer overflow vulnerability in WhatsApp VOIP [voice over internet protocol] stack allowed remote code execution via specially crafted series of SRTCP [secure real-time transport protocol] packets sent to a target phone number.”

Prof Alan Woodward from the University of Surrey said it was a “pretty old-fashioned” method of attack.

“A buffer overflow is where a program runs into memory it should not have access to. It overflows the memory it should have and hence has access to memory in which malicious code can potentially be run,” he explained.

“If you are able to pass some code through the app, you can run your own code in that area.

“In VOIP there is an initial process that dials up and establishes the call, and the flaw was in that bit. Consequently you did not need to answer the call for the attack to work.”

Who is behind the software?

The NSO Group is an Israeli company that has been referred to in the past as a “cyber-arms dealer”.

While some cyber-security companies report the flaws they find so that they can be fixed, others keep problems to themselves so they can be exploited or sold to law enforcement.

The NSO Group is part-owned by the London-based private equity firm Novalpina Capital, which acquired a stake in February.

NSO’s flagship software, Pegasus, has the ability to collect intimate data from a target device, including capturing data through the microphone and camera, and gathering location data.

In a statement, the group said: “NSO’s technology is licensed to authorised government agencies for the sole purpose of fighting crime and terror.

“The company does not operate the system, and after a rigorous licensing and vetting process, intelligence and law enforcement determine how to use the technology to support their public safety missions. We investigate any credible allegations of misuse and if necessary, we take action, including shutting down the system.

“Under no circumstances would NSO be involved in the operating or identifying of targets of its technology, which is solely operated by intelligence and law enforcement agencies. NSO would not or could not use its technology in its own right to target any person or organisation.”

Who has been targeted?

WhatsApp said it was too early to know how many users had been affected by the vulnerability, although it added that suspected attacks were highly-targeted.

According to the New York Times, one of the people targeted was a London-based lawyer involved in a lawsuit against the NSO Group.

Amnesty International, which said it had been targeted by tools created by the NSO Group in the past, said this attack was one human rights groups had long feared was possible.

“They’re able to infect your phone without you actually taking an action,” said Danna Ingleton, deputy programme director for Amnesty Tech. She said there was mounting evidence that the tools were being used by regimes to keep prominent activists and journalists under surveillance.

“There needs to be some accountability for this, it can’t just continue to be a wild west, secretive industry.”

On Tuesday, a Tel Aviv court will hear a petition led by Amnesty International that calls for Israel’s Ministry of Defence to revoke the NSO Group’s licence to export its products.

What are the unanswered questions?

  • How many people were targeted? WhatsApp says it is too early in its investigation to say how many people were targeted, or how long the flaw was present in the app
  • Does updating WhatsApp remove the spyware? While the update fixes the flaw that let this attack take place, WhatsApp has not said whether the update removes any spyware that has already infected a compromised device
  • What could the spyware do? WhatsApp has not said whether the attack could extend beyond the confines of WhatsApp, reaching further into a device and accessing emails, photos and more

“Using an app as an attack route is limited on iOS as they run apps in very tightly controlled sandboxes,” said Prof Woodward. “We’re all assuming that the attack was just a corruption of WhatsApp but analysis is still ongoing.

“The nightmare scenario would be if you could get something much more capable onto the device without the user having to do anything,” he said.

Spread the love
  •  
  •  
  •  
  •  
  •  
  •  
  •  

9 Comments

  1. jenna

    17th May 2019 at 2:41 PM

    If you think your spouse is cheating, click on this link to find out for sure
    https://medium.com/@webseosmm.net/hire-a-hacker-a8c21435ab5e

  2. 메이저사이트

    25th March 2020 at 12:40 PM

    ed some nice points there. I did a search on the topic and found
    the majority of people will have the same opinion with your
    blog.

  3. 카지노사이트www.pgame77.com

    29th June 2020 at 8:34 AM

    https://www.SKS700.com/ 바카라사이트
    https://www.SKS700.com/toswm1 카지노사이트
    https://www.SKS700.com/ejzldzkwlsh2 온라인카지노
    https://www.SKS700.com/vjtmxmzkwlsh3 카지노게임
    https://www.SKS700.com/bkl11 바카라게임
    https://www.SKS700.com/dnflzkwlsh 온라인바카라
    https://www.SKS700.com/blog-1 카지노바카라
    https://www.MAS47.com/ 우리카지노
    https://www.MAS47.com/sands77 샌즈카지노
    https://www.MAS47.com/theking1922 더킹카지노
    https://www.MAS47.com/firstcasino777 퍼스트카지노
    https://www.MAS47.com/hee2 호게임
    https://www.MAS47.com/kanm22 카지노
    https://www.MAS47.com/blog-1 우리바카라
    https://www.caba-agency.com/ 카지노게임사이트
    https://www.caba-agency.com/yescasino 카지노
    https://www.caba-agency.com/thekingcasino 카지노사이트
    https://www.caba-agency.com/firstcasino 바카라사이트
    https://www.caba-agency.com/blog 샌즈카지노
    https://www.ggame77.com/ 바카라사이트
    https://www.ggame77.com/spiderman111 카지노사이트
    https://www.ggame77.com/hulk111 온라인카지노
    https://www.ggame77.com/superman111 카지노게임
    https://www.ggame77.com/captain111 바카라게임
    https://www.ggame77.com/home-7 온라인바카라
    https://www.ggame77.com/home-5 카지노바카라
    https://www.ggame77.com/home-6 우리카지노
    https://www.ggame77.com/home-4 샌즈카지노
    https://www.ggame77.com/home-3 더킹카지노
    https://www.pgame77.com/ 퍼스트카지노
    https://www.pgame77.com/san123 호게임
    https://www.pgame77.com/dkkjn77 카지노
    https://www.pgame77.com/pstkjn77 우리바카라
    https://www.pgame77.com/kkkn77 카지노게임사이트
    https://www.pgame77.com/kkjjnn77 카지노
    https://www.pgame77.com/bbkkll22 카지노사이트
    https://www.jgame77.com/ 카지노사이트
    https://www.jgame77.com/mma29 샌즈카지노
    https://www.jgame77.com/kang11 우리카지노
    https://www.jgame77.com/fang22 바카라사이트
    https://www.jgame77.com/sk3sk3 더킹카지노

  4. 카지노사이트

    8th July 2020 at 2:16 AM

    in the provision of high-class sports betting and casino gaming products and will assist it in its global expansion plans. https://www.bomnar33.com 카지노사이트

  5. 카지노사이트

    8th July 2020 at 2:21 AM

    growing iGaming and sports betting brand could deliver on its strategy.
    https://www.bomnar33.com – 카지노사이트

  6. 카지노사이트

    8th July 2020 at 2:22 AM

    that after they received their MGA license, they are now excited to have secured another important partnership with a leading content provider.
    https://www.oma777.com – 카지노사이트

  7. BTL카지노

    19th July 2020 at 3:22 AM

    PLAY CASINO GAMES ONLINE:

    https://www.btlcasino.com 카지노사이트
    https://www.btlcasino.com/theking 더킹카지노
    https://www.btlcasino.com/sands 샌즈카지노
    https://www.btlcasino.com/first 퍼스트카지노
    https://www.btlcasino.com/yes 예스카지노
    https://www.btlcasino.com/super 슈퍼카지노
    https://www.btlcasino.com/gatsby 개츠비카지노
    https://www.btlcasino.com/33 33카지노

Leave a Reply

Your email address will not be published. Required fields are marked *