provider is taking legal action against a private entity that has
carried out malicious attacks against its users.
Facebook filed a lawsuit against Israeli mobile surveillance
firm NSO Group on Tuesday, alleging that the company was actively
involved in hacking users of its end-to-end encrypted WhatsApp
messaging service.
Earlier this year, it was discovered that WhatsApp had a
critical vulnerability that attackers were found exploiting in
the wild to remotely install Pegasus spyware
on targeted Android and iOS
devices.
[1][2][3]
The flaw (CVE-2019-3568) successfully allowed attackers to silently
install the spyware app on targeted phones by merely placing a
WhatsApp video call with specially crafted requests, even when the
call was not answered.
Developed by NSO Group, Pegasus allows access to an incredible
amount of data from victims’ smartphones remotely, including their
text messages, emails, WhatsApp chats, contact details, calls
records, location, microphone, and camera.
Pegasus is NSO’s signature product that has previously been used
against several human rights
activists[4] and journalists, from
Mexico[5] to the United Arab
Emirates two years ago, and Amnesty
International staffers[6]
in Saudi Arabia and another Saudi human rights defender based
abroad earlier last year.
Though NSO
Group[7] always claims it legally
sells its spyware only to governments with no direct involvement,
WhatsApp head Will Cathcart says the company has evidence of NSO
Group’s direct involvement in the recent attacks against WhatsApp
users.
NSO Group Violated WhatsApp’s Terms of Service
In a lawsuit filed (PDF[8]) in U.S. District Court
in San Francisco today, Facebook said NSO Group had violated
WhatsApp’s terms of services by using its servers to spread the
spyware to approximately 1,400 mobile devices during an attack in
April and May this year.
The company also believes that the attack targeted “at least 100
members of civil society, which is an unmistakable pattern of
abuse,” though it says this number may grow higher as more victims
come forward.
“This attack was developed to access messages after they were
decrypted on an infected device, abusing in-app vulnerabilities and
the operating systems that power our mobile phones,” Facebook-owned
WhatsApp said in a blog post[9].
“Defendants (attackers) created WhatsApp accounts that they used
and caused to be used to send malicious code to Target Devices in
April and May 2019. The accounts were created using telephone
numbers registered in different counties, including Cyprus, Israel,
Brazil, Indonesia, Sweden, and the Netherlands.”
activists, political dissidents, diplomats, and other senior
foreign government officials, with WhatsApp numbers from different
country codes, including the Kingdom of Bahrain, the United Arab
Emirates, and Mexico.
1,400 users impacted by this attack, directly informing them about
what happened.
Facebook has also named NSO Group’s parent company ‘Q Cyber
Technologies’ as a second defendant in the case.
“The complaint alleges they violated both U.S. and California laws
as well as the WhatsApp Terms of Service, which prohibits this type
of abuse,” the lawsuit states.
and federal laws, including the Computer Fraud and Abuse Act, as
well as the California Comprehensive Computer Data Access and Fraud
Act.
References
- ^
WhatsApp had a critical
vulnerability (thehackernews.com) - ^
Pegasus spyware
(thehackernews.com) - ^
Android
(thehackernews.com) - ^
human rights activists
(thehackernews.com) - ^
Mexico
(thehackernews.com) - ^
Amnesty International staffers
(thehackernews.com) - ^
NSO Group
(thehackernews.com) - ^
PDF
(www.scribd.com) - ^
blog post
(faq.whatsapp.com)
Read more http://feedproxy.google.com/~r/TheHackersNews/~3/HUx_oyb8AA8/whatsapp-nso-group-malware.html