WhatsApp voice calls were used to inject spyware on phones

A vulnerability in the messaging app WhatsApp has allowed attackersto inject commercial Israeli spyware on to phones, the company and a spyware technology dealer said.

WhatsApp, which is used by 1.5bn people worldwide, discovered in early May that attackers were able to install surveillance software on to both iPhones and Android phones by ringing up targets using the app’s phone call function.

The malicious code, developed by the secretive Israeli company NSO Group, could be transmitted even if users did not answer their phones, and the calls often disappeared from call logs, said the spyware dealer, who was recently briefed on the WhatsApp hack.

WhatsApp is too early into its own investigations of the vulnerability to estimate how many phones were targeted using this method, a person familiar with the issue said.

As late as Sunday, as WhatsApp engineers raced to close the loophole, a UK-based human rights lawyer’s phone was targeted using the same method.

Researchers at the University of Toronto’s Citizen Lab said they believed that the spyware attack on Sunday was linked to technology developed by NSO, which was recently valued at $1bn in a leveraged buyout that involved the UK private equity fund Novalpina Capital.

NSO’s flagship product is Pegasus, a program that can turn on a phone’s microphone and camera, trawl through emails and messages and collect location data.

NSO advertises its products to Middle Eastern and Western intelligence agencies, and says Pegasus is intended for governments to fight terrorism and crime.

In the past, human rights campaigners in the Middle East have received text messages over WhatsApp that contained links that would download Pegasus to their phones.

WhatsApp said that teams of engineers had worked around the clock in San Francisco and London to close the vulnerability. It began rolling out a fix to its servers on Friday last week, WhatsApp said, and issued a patch for customers on Monday. The US Department of Justice has also begun looking into the situation.

“This attack has all the hallmarks of a private company known to work with governments to deliver spyware that reportedly takes over the functions of mobile phone operating systems,” the company said. “We have briefed a number of human rights organisations to share the information we can, and to work with them to notify civil society.”

NSO said it had carefully vetted customers and investigated any abuse. Asked about the WhatsApp attacks, NSO said it was investigating the issue.

“Under no circumstances would NSO be involved in the operating or identifying of targets of its technology, which is solely operated by intelligence and law enforcement agencies,” the company said. “NSO would not, or could not, use its technology in its own right to target any person or organisation, including this individual [the UK lawyer].”

NSO declined to comment on whether it had hacked WhatsApp’s messaging service, and marketed the technology to clients, or on the US DoJ inquiry.

The UK lawyer, who declined to be identified, has helped a group of Mexican journalists and government critics and a Saudi dissident living in Canada, sue NSO in Israel, alleging that the company shares liability for any abuse of its software by clients.

John Scott-Railton, a seniorresearcher at the University of Toronto’s Citizen lab, said the attack had failed.

“We had a strong suspicion that the person’s phone was being targeted, so we observed the suspected attack, and confirmed that it did not result in infection,” said Mr Scott-Railton. “We believe that the measures that WhatsApp put in place in the last several days prevented the attacks from being successful.”

Other lawyers working on the cases have been approached by people pretending to be potential clients or donors, who then try and obtain information about the ongoing lawsuits, the Associated Press reported in February.

“It's upsetting but not surprising that my team has been targeted with the very technology that we are raising concerns about in our lawsuits,” said Alaa Mahajne, a Jerusalem-based lawyer who is handling lawsuits from the Mexican and Saudi citizens. “This desperate reaction to hamper our work and silence us, itself shows how urgent the lawsuits are, as we can see that the abuses are continuing.”

On Tuesday, NSO will also face a legal challenge to its ability to export its software, which is regulated by the Israeli ministry of defence.

Amnesty International, which identified an attempt to hack into the phone of one its researchers, is backing a group of Israeli citizens and civil rights group in a filing in Tel Aviv asking the ministry of defence to cancel NSO’s export licence.

“NSO Group sells its products to governments who are known for outrageous human rights abuses, giving them the tools to track activists and critics. The attack on Amnesty International was the final straw,” said Danna Ingleton, deputy director of Amnesty Tech.

“The Israeli ministry of defence has ignored mounting evidence linking NSO Group to attacks on human rights defenders. As long as products like Pegasus are marketed without proper control and oversight, the rights and safety of Amnesty International’s staff and that of other activists, journalists and dissidents around the world is at risk.”

byron_wan• 7 years ago

Is this the full FT article?

tekknolagi2• 7 years ago

Looks like it, from the archive.is link above.

macintux2• 7 years ago

Nice of you to include the copyright line in your violation of same.

galadran• 7 years ago

Interesting!

Google's Project Zero team investigated WhatsApp's and Facetime's video conferencing last year:

"Overall, WhatsApp signalling seemed like a promising attack surface, but we did not find any vulnerabilities in it. There were two areas where we were able to extend the attack surface beyond what is used in the basic call flow. First, it was possible to send signalling messages that should only be sent after a call is answered before the call is answered, and they were processed by the receiving device. Second, it was possible for a peer to send voip_options JSON to another device. WhatsApp could reduce the attack surface of signalling by removing these capabilities."

"Using this setup, I was able to fuzz FaceTime calls and reproduce the crashes. I reported three CVEs in FaceTime based on this work."

WhatsApp: https://googleprojectzero.blogspot.com/2018/12/adventures-in...

Facetime: https://googleprojectzero.blogspot.com/2018/12/adventures-in...

In both cases, the close source nature of the applications stymied their efforts. Looks like NSO was willing to spend more time and resources!

pvg2• 7 years ago

In both cases, the close source nature of the applications stymied their efforts.

Why do you say that? In the WhatsApp case, they were able to repeatedly modify the code and also yank it out and run it in their own controlled environment, etc.

criley2• 7 years ago

From my experience, working with real source from the repo with comments etc is very different than working with reverse engineered binaries.

That's probably what they're referring to.

ec109685• 7 years ago

NSO wasn't the group that did the WhatsApp hack. They are the software the hacker installs after they exploit has been found.

Relys• 7 years ago

I literally just attended Natalie Silvanovich's talk at Infiltrate. Very interesting work.

aaomidi• 7 years ago

How were they able to install spyware on iOS devices?

xenospn6• 7 years ago

Since there's no version information available, I think it's safe to assume they haven't been doing it on iOS for several years.

thinkling• 7 years ago

It's not clear to me if you're right, but I would rephrase the issue this way:

If there's a vulnerability in Whatsapp, the injected code should only affect Whatsapp.

Otherwise, it's (also) a vulnerability in iOS.

askvictor• 7 years ago

Or Android devices for that matter; app code is sandboxed and signed, and requires user interaction to download any non store code

wahern2• 7 years ago

The secure enclaves on Android smartphones have a poor track record. Even the top-of-the-line manufacturers have seen published hacks of their TEE environments, and those are usually just the tip of the iceberg. Android is incomparable to Apple's platform in this regard. (I'm not trying to argue the iPhone is unhackable, though.)

FWIW, I'm an Android user.

nvr219• 7 years ago

right?

snowwrestler• 7 years ago

Most likely by exploiting an iOS vulnerability . (Which might be unrelated to the WhatsApp bug, other than using it as a vector.)

kristofferR2• 7 years ago

The spyware is only inside the WhatsApp sandbox.

floatingatoll12• 7 years ago

No one has confirmed whether they were able to install anything beyond the confines of the app on iOS. The press are not particularly qualified to evaluate that consideration and have been doing a poor job of blurring what’s unlikely/impossible on iOS with what’s likely/possible on Android.

bjourne5• 7 years ago

All my life I've thought spyware was developed primarily by evil Russian and Chinese hackers. But apparently also by Israeli developers with their government's blessing and open endorsement. That's some very shady stuff.

Before someone says something about government surveillance of fiber cables. Yes, that is also bad, but exploiting vulnerabilities to install spyware on peoples phones... It crosses yet another line that shouldn't ever be crossed.

icelancer2• 7 years ago

There was Stuxnet, which was almost certainly a joint US/Israeli operation (likely other minor players involved), and plenty of other programs we never hear about.

xenospn6• 7 years ago

They managed to destroy Iranian nuclear centrifuges using a very sophisticated attack. Read up on Stuxnet.

Also, as an Israeli, I can 100% confirm that Israelis have absolutely no issues with crossing any kind of boundary. The fact that others think that such a thing as "boundaries" exist only serves as an advantage.

seppin• 7 years ago

The fact that others think that such a thing as "boundaries" exist only serves as an advantage.

Isn't this how villains in Marvel movies work?

olivermarks2• 7 years ago

Not clear whether you consider this a good thing or a disgrace?

savethefuture• 7 years ago

Interesting to hear about this lack of boundaries among Israelis, is this only for non-Israelis or do you/they cross each others boundaries? Is this a cultural thing, why do you think this the case?

ct5202• 7 years ago

I’m sure it was completely Israeli government involvement with the technologically advanced US playing no lead role. ...

mirimir5• 7 years ago

From what I've seen, they're not at all unique. Maybe they're more honest about it, though. And given that they're surrounded by enemies, they must maintain that reputation.

"I'm crazier than you are." has always been the US position re strategic nuclear weaponry.

dane-pgp• 7 years ago

I can 100% confirm that Israelis have absolutely no issues with crossing any kind of boundary.

Is this a subtle reference to the Israeli occupation of Palestine?

wyclif• 7 years ago

I agree. Nobody should underestimate the Mossad: https://youtu.be/bJujIwtdk8w

deytempo• 7 years ago

How do they differ from international terrorists then?

discordance• 7 years ago

The Wired writeup on Stuxnet and the actors involved was an incredible read:

https://www.wired.com/2014/11/countdown-to-zero-day-stuxnet/

ionised3• 7 years ago

Also, as an Israeli, I can 100% confirm that Israelis have absolutely no issues with crossing any kind of boundary. The fact that others think that such a thing as "boundaries" exist only serves as an advantage.

Maybe as an Israeli you can see the hypocrisy in stating that there are no boundaries when, if it wasn't for a large part of the world deciding that in fact there ARE boundaries that should not be crossed, the Nuremberg trials would never have been held and Israel would not exist at all.

But you go ahead and ignore your own history.

eof2• 7 years ago

I love how you’ve been convinced that Russia and China are naughty and Israel is somehow too good to be shady.

macintux2• 7 years ago

Well, the first half of that statement seems undeniably true.

mmsimanga• 7 years ago

To be fair it's not just about the software but about the country too. We know know China's policy on censoring the web. Russia is not the sort of place that tolerates activism against Putin. So when you combine this with hacking people's phones it does make it much worse.

romanovcode• 7 years ago

Propaganda at work it seems

StreamBright• 7 years ago

Not at all, many EU countries produce such tools, some even commercially sold.

coreman2• 7 years ago

All my life I've thought spyware was developed primarily by evil Russian and Chinese hackers. But apparently also by Israeli developers with their government's blessing and open endorsement. That's some very shady stuff.

Gamma Group is an Anglo-German company that provides similar surveillance software with government blessing and endorsement. Hacking Team (Italian company) sells similar surveillance software to various European governments. Before an embarrassing data breach in 2015 they also used to sell surveillance software to various totalitarian regimes outside Europe.

jakobegger• 7 years ago

Before an embarrassing data breach in 2015 they also used to sell surveillance software to various totalitarian regimes outside Europe.

Why do you think they stopped selling to those regimes? (I didn't follow the issue after it disappeared from the news)

leriksen• 7 years ago

work out what your enemy considers an uncrossable boundary - then cross it - gets them every time.

source - Art of War, probably...

StanislavPetrov2• 7 years ago

All my life I've thought spyware was developed primarily by evil Russian and Chinese hackers.

You've led a very sheltered life if you think the Russians and the Chinese have been more evil than the Americans or the Israelis. I suggest reading history - a lot of it. When it comes to governments there are no good guys, only bad guys.

dash22• 7 years ago

I’ve read a lot of history. Your last statement is kind of fair. Your first statement is not. (Does eg US imperialism make Roosevelt no better than Hitler? Of course not.)

The Russians and Chinese are doing many things worse than what the US does: Ukraine, the Uighurs.... Both are far less bound by the rule of law. Neither have any serious form of democracy.

False equivalence is a specious but dangerous form of reasoning.

int_19h• 7 years ago

You're talking about a government that has a long track record of assassinating and abducting people in other countries, including Western liberal democracies.

https://en.wikipedia.org/wiki/List_of_Israeli_assassinations...

https://en.wikipedia.org/wiki/Mordechai_Vanunu#Disclosure,_a...

Whatever lines there were, they have long been crossed.

lixtra2• 7 years ago

Abducting people in western countries unfortunately seems to be the norm in the war on terror, not only by the Israelis [1].

[1] https://en.m.wikipedia.org/wiki/Abu_Omar_case

quickthrower2• 7 years ago

Before someone says something about government surveillance of fiber cables.

Anything that goes unencrypted over the internet is (a) public and (b) liable to be changed by anyone on transit. It's like a travelling wikipedia article.

HillaryBriss• 7 years ago

crossing a new line is a way to signal your opponent that you're unafraid of any and all of their potential retaliation. it is a way to tell them that (you think) you dominate them.

rmrfrmrf• 7 years ago

And the US government's blessing. Along with the UK, this is how the US indirectly spies on its own citizens.

noelsusman• 7 years ago

I would be shocked if any moderately wealthy government hasn't crossed that line. This is child's play for cyber warfare.

dontbenebby• 7 years ago

I remember when "spyware" was just malicious advertising programs designed to sell your browser history + replace ads.

(Eg: https://en.wikipedia.org/wiki/CoolWebSearch)

The MySpace era was a simpler time...

qrbLPHiKpiux• 7 years ago

That's some very shady stuff.

By them, I’m not surprised. And I’m not being anti Semitic. I’m just calling fact.

lm284692• 7 years ago

All my life I've thought spyware was developed primarily by evil Russian and Chinese hackers.

They're build by any government/entity having sufficient resources to build them, there is no good or bad guys in that story.

zaro• 7 years ago

All my life I've thought spyware was developed primarily by evil Russian and Chinese hackers.

Yep, manufacturing of consent at play.

But this aside, I have a friend who worked in Israeli company whose main business was to sell phone exploits and customer data by using the still very insecure SS7. Basically they were registered as voip operator, but according to my friend that was only a cover, and the real business was selling surveillance data they were gathering via SS7.

notlukesky• 7 years ago

Hey Zaro. The author of the FT article would love to have a chat with you and maybe get a quote for a follow-up article. His email is: mehul.srivastava@ft.com

roywiggins3• 7 years ago

It's not just the NSO group. Hacking Team is not exactly shy about the services they offer.

https://en.wikipedia.org/wiki/Hacking_Team

FinFisher: https://en.wikipedia.org/wiki/FinFisher

MiniPanzer: https://en.wikipedia.org/wiki/MiniPanzer_and_MegaPanzer

wahern2• 7 years ago

Yeah, there's a cottage industry of security firms who sell exploits to the U.S. government directly or indirectly through big defense contractors. Many, and I personally have assumed _most_ (but without checking), are American firms.

And, frankly, the Israeli industry has much to gain by advertising their prowess in order to bolster their IT security bone fides internationally. American firms are probably more discrete, so tabulating widely published exploits by country of origin wouldn't be a great metric to determine which country is doing the most work crafting exploits.

avip4• 7 years ago

the Israeli industry has much to gain by advertising their prowess in order to bolster their IT security bone fides internationally

Absolutely. The Israeli Cybersecurity brand is built partially on such (sometimes unsubstantial) PR.

The bubble is doing well though! almost 500 startups, > 1Billion$ VC funding in 2018 alone. Devs are happy.

bjourne5• 7 years ago

Wow! I had no idea there was a whole industry selling spyware to dictatorships. Surveillance equipment, yes, but not actual hacking tools. Really sickening. Must be why governments in Europe are so afraid of Huawei building 5G networks - they will only run Chinese spyware.

jplayer012• 7 years ago

It wouldn't even matter if Huawei doesn’t and has never used their position in infrastructure to conduct spying or surveillance. The very fact that they’re entirely reliant on the Chinese government makes them (and any of their employees on an individual level) vulnerable to Chinese policy needs, now or in the future.

roywiggins3• 7 years ago

It's not that much different from mercenary outfits like The Company Formerly Known As Blackwater. They offer services to all sorts of unsavory regimes. Hackers for hire are just another iteration on the idea.

Buge• 7 years ago

I don't quite understand the Huawei analogy. NSO isn't partnering with Israeli companies to preinstall malware on their stuff. So I don't see how this is an indication that a Chinese version of NSO will partner with Huawei to preinstall malware on Huawei stuff. If NSO can hack American software, then Chinese NSO can hack American software too.

metildaa2• 7 years ago

Huawei's equipment will almost assuredly run anyone's spyware. Huawei uses a medley of ancient, highly vulnerable OpenSSL libraries sprinkled through their basestation code, and apparently they've forgone any kind of version control to ensure an optimally confusing work environment for their development teams: https://hmgstrategy.com/resource-center/articles/2019/04/04/...

Frankly, these products are likely unmaintainable long term without a total refactoring of the codebase, nevermind the abject lack of security.

The trick with these vendors is the codebase will never see serious improvement, as these basestations aren't going to be sold for the next decade, so Huawei will do the bare minimum and shelve support in short order.

walrus01• 7 years ago

The Israeli military-industrial ELINT industry and C4I people sell stuff to all sorts of authoritarian regimes. Even the ones that the US and UK won't touch.

gsich• 7 years ago

Why should a RAN have Internet connection?

jmkni3• 7 years ago

IIRC FinFisher was founded by the same guy who created Backtrack (now Kali Linux)?

a-dub• 7 years ago

Maybe that would explain the mysterious WhatsApp voice call I received about a week ago in the middle of the night from an unknown number? It's still in the history so maybe that means it didn't work?

MagicPropmaker2• 7 years ago

Are you involved with anything that would make you think you'd be worth someone's time and money to be spying on? Most likely it was a wrong number.

JacobHenner• 7 years ago

Wonder if this affects Signal, too.

joecool1029• 7 years ago

My gut tells me no. Signal switched over to using the Signal Protocol for call signaling. It had used a few different signaling standards over the years (when it used to be called Redphone).

However, it's impossible to really know for sure as the server component for calls is a proprietary black box.

jtl9993• 7 years ago

However, it's impossible to really know for sure as the server component for calls is a proprietary black box.

I thought that changed after migrating to WebRTC? Although I haven't tried to spin up my own Signal server, modify the APK and see what works and doesn't work.

cottsak• 7 years ago

Agreed. It seems more plausible that the "injected code" would be limited to (1) the WhatsApp app, and (2) the infrastructure outside of the Signal Protocol implementation. If true, this still poses a problem to comms/calls secured end-to-end with the Signal Protocol impl - because once decrypted on the client, the rest of the WhatsApp may be compromised and able to exfil comms.

I will be surprised, if this vuln allows the attacker control outside of the WhatsApp app sandbox to other parts of iOS.

(I will be less surprised if the above is possible in Android)

olivermarks2• 7 years ago

https://www.zerohedge.com/news/2019-05-13/secretive-israeli-...

sb057• 7 years ago

This is the same country that has a secret nuclear stockpile (developed in partnership with Apartheid South Africa) with plans to use the threat of bombing their European "allies" as blackmail.

https://en.wikipedia.org/wiki/Samson_Option

coreman2• 7 years ago

The "Samson Option" is a conspiracy theory that if Israel is ever at the brink of destruction it will nuke Europe and America. It is a conspiracy theory based on the ramblings of one Israeli historian and one American author.

Israel has nuclear weapons and its MAD policies are probably the same as other nuclear powers.

It's funny because Putin has actually said that Russia will end up destroying the entire world in retaliation if Russia is ever attacked with nuclear weapons. But for some reason you don't see this quote get the same attention as the "Samson Option".

‘Why would we want a world without Russia?'

Days later, he reiterated his stance, implying that nuclear war — a “disaster for the entire world” — would be a response to a major attack against Russia: “as a citizen of Russia and the head of the Russian state, I must ask myself: ‘Why would we want a world without Russia?'”

‘Why would we want a world without Russia?'

https://www.japantimes.co.jp/opinion/2019/01/27/commentary/w...

lostlogin3• 7 years ago

Israel has nuclear weapons and its MAD policies are probably the same as other nuclear powers.

But with a much more controversial relationship with it neighbours, who’s land it illegally occupies and state policies that are compared to apartheid policies.

mirimir5• 7 years ago

The US position is basically the same. Indeed, the US has warned that it may respond with nuclear weapons to cyberattacks.

bikeshed• 7 years ago

Has it ever been established that Israel has nuclear weapons? As far as I’ve heard it’s just a rumour.

eitland• 7 years ago

with plans to use the threat of bombing their European "allies" as blackmail.

I read through this but was not able to find anything about bombing allies.

Can you point to exactly where it is written?

dang8• 7 years ago

We detached this subthread from https://news.ycombinator.com/item?id=19905363 and marked it off-topic.

thelittleone• 7 years ago

I guess these types of vulnerabilities could be placed intentionally. It would allow certain agencies to again access via "exploit" and all the while claim they support user privacy. These companies are under pressure from governments (like the recent Australian government law to requiring access to encrypted messages). Seems like a decent solution for company and governments.

bouncycastle3• 7 years ago

It's not a decent solution, because it doesn't take much to find these vulnerabilities, just a matter of time.

lixtra2• 7 years ago

But time is enough. New bugs can be introduced with the next update.

p0rkbelly• 7 years ago

The industry calls this a "bug-door" and yes, plausible deniability is key. Most of this has been hypothetical possibility. This case does not fit that bill though as the vendor discovered it was being used by another country, prevented the exploit against a user, fixed it, and alerted the authorities. Would be more peculiar if it was a US-based company selling the spyware.

ridaj• 7 years ago

Do a Google search for "underhanded C contest".

rjf72• 7 years ago

There's also the curiously peculiar, and consistent, wording from companies that deny their involvement in programs such as PRISM [1]. As people seem to have forgotten about PRISM, NSA slides not meant for public consumption stated it enabled "extensive, in-depth surveillance on live communications and stored information" with examples including email, video and voice chat, videos, photos, voice-over-IP chats (such as Skype), file transfers, and social networking details.

But here's the fun part. Here are the corporate denials:

- Google: "We have not joined any program that would give the U.S. government direct access to our servers."

- Apple: "We do not provide any government agency with direct access to our servers."

- Facebook: "We do not provide any government organization with direct access to Facebook servers."

And so on. An exploit with plausible deniability enables these companies to make these comments completely truthfully, and at least mostly truthfully if they claim they are not providing a backdoor. But more to the point, there is absolutely no reason these companies would all say "direct access" as that's very specifically a subset of "access." If you do not facilitate direct or indirect access, why would you not simply say access? If this were a one-off thing, that'd be one thing since on occasion some PR is... odd. But literally all the companies were saying the exact same very peculiar thing. That's not a coincidence.

[1] https://en.wikipedia.org/wiki/PRISM_%28surveillance_program%...

WC3w6pXxgGd• 7 years ago

And nobody was surprised.

accountwhatever2• 7 years ago

Why was the word "Israeli" removed from the title?

zaroth• 7 years ago

OT, but scroll down with “showdead” and it should become apparent exactly why. It is HN trying to promote substantive discussion on the topic without devolving into flame war.

dang8• 7 years ago

I took it out because the thread was veering into generic flamewar about Israel. Actually we often remove country names from titles because they trigger people into making more nationalistic comments, which are equal parts indignant and boring.

accountwhatever2• 7 years ago

Oh, I see, that makes a lot of sense actually. Thank you for your service!

anonymousDan3• 7 years ago

That's a bit of a pathetic policy if you ask me. In my opinion a country who permits this type of behaviour shouldn't be shielded from the ensuing negative press. If anything it might encourage otherwise unaware citizens to put pressure on the government to do something about it.

ak393• 7 years ago

Dan, you know what would be cool for HN comments? The ability for each node of a thread to be annotated with topic names. For example, if the node close to the root node here were to be labelled "Israeli politics", I, a user interested in the technical aspects of the topic, can immediately avoid it. This feature will be a killer feature for all topics that have divergent sub-threads! (I haven't thought further than just the annotation by end user feature - so, whether it ought to be at user level or a global one ... I don't know). :-D

kurthr• 7 years ago

The title has been modified.

WhatsApp voice calls used to inject Israeli spyware on phones

dang8• 7 years ago

Sure, we take out the baity parts of titles because they produce lousier discussion. This is standard HN moderation: https://news.ycombinator.com/newsguidelines.html. See https://news.ycombinator.com/item?id=19906729 for more explanation.

nomercy400• 7 years ago

But isn't it also baity to use 'used to'. My first reaction now was that Whatsapp itself has been inserting spyware into their phone calls, but no longer is (=used to), yet after reading the (non-paywalled) article I now see that a vulnerability in their signaling protocol has been used by others (=used to) to allow remote code injection.

Removing the creator of the spyware part from the title now causes the blame of the spyware to shift to Whatsapp, which is incorrect.

bjourne5• 7 years ago

Cursory Google searches seem to indicate that the same policy isn't applied for Chinese or Russian cyber threats. You also didn't remove the country name in other recent news, despite the production of even lousier discussion: https://news.ycombinator.com/item?id=19638357 https://news.ycombinator.com/item?id=19634570 The moderation is inconsistent.

OrgNet• 7 years ago

Yeah, don't install any Facebook app... use the web if you need to use their service... same advice has always been true.

EGreg• 7 years ago

We need open source software to decentralize large companies’ closed server farms and WhatsApp.

jpangs88• 7 years ago

This was behind a paywall, here is a similar article:

https://www.bbc.com/news/technology-48262681

dbrgn2• 7 years ago

Here's an article without paywall: https://www.bbc.com/news/technology-48262681

joshlk• 7 years ago

The article is behind a paywall. Here is a BBC link: https://www.bbc.co.uk/news/technology-48262681

kmarc• 7 years ago

I am not an expert on RCEs whatsoever but my limited knowledge / gut feeling tells me that one works by after a buffer overflow flipping some bits and

* invoking syscalls

* using (known) kernel vulnerabilities

* libc bugs

* exploiting buggy posix abstraction, etc.

However, here all platforms seem to be exploited, regardless kernels (darwin/linux/windows), process models, libc implementations etc.

I cannot unthink that this was simply doable because WhatsApp had already have code paths to place and run tasks/processes and this exploit works on this, higher level.

SeriousM• 7 years ago

Paywall, really?

ezequiel-garzon• 7 years ago

It seems to me that if this is possible an OS software upgrade of some sort is urgently required, in addition to possible updates of WhatsApp. How come there isn’t coverage of this as Android and iOS vulnerabilities?

floatingatoll12• 7 years ago

Gaining control of WhatsApp gains access to any API accessible to WhatsApp. Incompetent reporting may be at fault.

On Android, WhatsApp seeks a wide array of permission-controlled APIs. It does so on iOS as well. Once granted, the app has access to any data available through access-allowed APIs.

App code goes through an audit process to ensure that the app isn’t using accessible APIs inappropriately, and doesn’t permit unapproved code execution.

This vulnerability allows an attacker to execute unapproved code in the WhatsApp context. Any API that iOS or Android offer WhatsApp under normal circumstances is now attacker-controlled.

The two questions unanswered by the press to date are simple. On iOS and on Android, can the attacker’s code be terminated by force-quitting and uninstalling WhatsApp?

Either the attack is persistent only because it sets up shop inside the app, which may have OS-granted background and/or screen-off execution rights, and thus can be terminated simply by quitting and removing the app — or, the attack gains persistence beyond the confines of the app.

Media reports are unclear on this point. If the OS offers apps endpoints that an app executing attacker-controlled code can use to infect the OS with persistent attack code that executes outside the app’s boundaries and remains after app uninstallation, then that’s absolutely a flaw in the design of the OS. As you say, “Android and iOS vulnerabilities”.

Is this the case?

iicc• 7 years ago

Do you happen to know if upgrading the app would remove persistence (inside the app)?

jmkni3• 7 years ago

Very interested to know what this means in practice, particularly for iOS.

AFAIK, there's no permissions which allow you to read SMS messages, take screenshots (unless jailbroken), access photos in the background, access the camera in the background etc etc

Does this just spy on the users Whatsapp activity, or spy on the user in a broader way?

How could the API's whatsapp does have access to be abused?

caoilte• 7 years ago

There should be different permissions for foreground and background access to APIs.

whycomb3• 7 years ago

Updated WhatsApp on my iphone just now. The version I got was 2.19.50. According to the CVE it's still vulnerable. Unable to get 2.19.51 which is the first fixed version. Is this just me? Or is everyone else updating to a still-vulnerable version?

majjam• 7 years ago

Just updated via UK iOS app store and its 2.19.50

whycomb3• 7 years ago

You're still vulnerable then.

"Affected versions: ... WhatsApp for iOS prior to v2.19.51" from https://www.facebook.com/security/advisories/cve-2019-3568

The news outlets are all telling us to update, but until WhatsApp/Apple get their act together, there's no point. Worse still, people won't realise they need to do it again and will remain vulnerable indefinitely.

Tepix2• 7 years ago

Have you tried pulling down on the updates screen of the iOS app store? It refreshes the list of apps to be updated.

Scoundreller4• 7 years ago

That did it. Thank you. And to think I thought I installed all of my pending updates yesterday.

entropy_• 7 years ago

You need to go to the app store app, then the updates tab and pull down to refresh(yes, the updates tab, not WhatsApp listing in the store). When you do that, you'll see the newest version becomes available for update. This happens whenever an update is set to phased release and hasn't reached 100% yet.

billysielu• 7 years ago

"update the app" is the sum of the advice?

how about telling us how to check if this exploit was used, how to remove the spyware, etc?

scraegg3• 7 years ago

I'm not sure what can be done nowadays. In the past you would say, format disks and go back to a backup before the threatening event happened. But nowadays all our stuff is in the cloud and you can only go back to the state from 10 minutes ago, and all our disks are flash drives that you can't fully format as an end user. Maybe you can just accept that some virusses will always be there and act accordingly.

Scoundreller4• 7 years ago

Some of us do snapshot backups.

Would be nice to have a tool that everyone on the planet could use to run against those backups and find a common source of the infections, along with an idea of when it was found in the wild.

vardump• 7 years ago

My desktop WhatsApp on macOS is crashing pretty regularly, once every few days. Really makes me wonder if I'm being targeted using similar exploits.

kuroguro• 7 years ago

It's probably the link preview preload. It can't handle certain sites and crashes almost instantly when trying to send a link.

scraegg3• 7 years ago

What about Wechat? There are lots of seemingly pretty girls trying to voice or video call these days. Either I'm suddenly rich in their eyes or there's something fishy going on.

toyg4• 7 years ago

That’s the more traditional scamming/phishing, which has been going on since the days of ICQ...

wil4212• 7 years ago

Name a chat app and I can provide a link or comment from someone saying the same thing about pretty scam girls. Facebook, Whatspp, Gmail, Kik, Snapchat, Instagram, and even BBSes, AOL, IRC etc...

scraegg3• 7 years ago

What I saw on FB is automatic replies from bots. What I know from Skype are african boys who try to earn their next beer in an internet cafe by acting they would be a girl. I can confirm it's all not that.

0898• 7 years ago

Just to be clear – does this affect iPhone, or just Android?

keyme• 7 years ago

Affects both

ak393• 7 years ago

Thanks. Is there a way to detect the infection?

dschuetz• 7 years ago

Why is that even possible? It's horrifying that simple voice calls via an app allow that kind of attack.

floatingatoll12• 7 years ago

Cellular broadband modems are running a tiny OS that can be hacked by sending SMS messages with a carefully crafted NUL byte. Battlestar Galactica’s “no networking, no wireless” computer restriction exists for a very good reason.

ricg• 7 years ago

Can the WhatsApp-injected spyware escape the iOS App Sandbox?

1f60c2• 7 years ago

I was wondering the same. I would hope no, but even so, WhatsApp has plenty of permissions that make it a valuable target.

lol7684• 7 years ago

CVE-2019-3568 suggests this was a buffer overflow. I'd like to understand why this was implemented in native code - Android seems to have an `android.net.rtp` package?

Is this simply for performance, or to enable code-sharing across Android and iOS? Is there anything about WhatsApp's use-case that would prevent an implementation using managed code?

auiya2• 7 years ago

Also, what exploitation mitigations are broken on Android/iOS such that a buffer overflow is reliably exploitable? Are their implementations of ASLR useless? Is it trivially bypassed? Is mandatory code-signing not enabled/enforced?

lol7684• 7 years ago

All very good questions, hopefully we can get some more information as time progresses (maybe a PoC, or at least a technical write-up on the specifics)

floatingatoll12• 7 years ago

Is Android.net.rtp available on every support Android and Google Library version combination that WhatsApp natively supports?

lol7684• 7 years ago

AIUI, no. That package was added in Honeycomb (API level 12), whereas WhatsApp currently supports Gingerbread (API level 10).

However, two API levels of compat. seems like a good trade to me in order to avoid an RCE.

anonymousDan3• 7 years ago

Can anyone advise on minimum version numbers containing the patch (on IOS and Android)?

floatingatoll12• 7 years ago

Listed here: https://www.facebook.com/security/advisories/cve-2019-3568

stunt2• 7 years ago

I wonder! Should we call it a vulnerability or a leaked backdoor?

Besides, I think if it was from any other developer, probably it would be removed from the AppStore and force delete from user devices.

ccnafr• 7 years ago

I like it how Facebook doesn't mention anything in the WhatsApp changelog about this.

cricalix• 7 years ago

Apple won't let you change a changelog after the binary is built and put on the store. So if you want to get a fix out, but not alert people that you're on to them, you have to put out a changelog that just says something like "Bugfixes". Then you have to build another build and submit another changelog, but Apple probably won't let you issue builds that are duplicates...

jonplackett2• 7 years ago

Isn’t this also a screw up by Apple?

Isn’t Sandboxing supposed to prevent this from getting any worse than hacking the app itself?

floatingatoll12• 7 years ago

Isn’t every article about this saying it persists, without saying how or whether it’s a sandbox escape? If it just spins up bad code in WhatsApp space, that’s sufficient to spy on you.

jonplackett2• 7 years ago

I'm sure I saw one say it infected the OS. I would like to know some more proper details too.

auiya2• 7 years ago

Userspace isolation doesn't matter when the malware only cares about what's in userspace.

Yuval_Halevi• 7 years ago

WhatsApp belongs to Facebook

Some of the largest data breaches in the last few years related to facebook

and yet

They continue do whatever they want

GDPR made no difference at all... Only hurt the small-medium business

FB, Google, Aamazon just keep doing whatever they want, protected by army of lawyers

redskull• 7 years ago

FT.com worst site in the world.. I thought you can't link things that require a subscription to read?

dave7• 7 years ago

For these, there is a link below the headline titled "web" - click this, it opens in a search that when clicked through allows reading.

rawrmaan• 7 years ago

Wow, TIL. Thanks!

leoh• 7 years ago

Spooky. I just travelled to Israel and this evening, at around 3 AM, iOS notified me that WhatsApp had been accessing my location in the background, which I had never seen before except when sharing my location with a friend.

TheSmoke• 7 years ago

is this how saudi activists were tracked or uae tapped the phones of govt officials from various countries?

GMLOOKO• 7 years ago

WhatsApp voice calls were used to inject spyware on phones

Related Stories