WhatsApp reveals major security flaw that could let hackers access phones

CNN/Stylemagazine.com Newswire | 5/14/2019, 10:35 a.m.
WhatsApp has revealed a vulnerability in its system that could have allowed hackers access to its users' phones, with a ...
WhatsApp has revealed a vulnerability in its system that could have allowed hackers access to its users' phones, with a London-based human rights lawyer possibly among the targets.

Originally Published: 14 MAY 19 02:02 ET

Updated: 14 MAY 19 11:00 ET

By Donie O'Sullivan, CNN Business

(CNN) -- WhatsApp has revealed a vulnerability in its system that could have allowed hackers access to its users' phones, with a London-based human rights lawyer possibly among the targets.

The encrypted messaging service, owned by Facebook, said Monday that it had discovered and fixed the vulnerability the attackers had sought to exploit. The hackers could implant malicious code on a victim's phone by placing a voice call to the victim on WhatsApp.

"The attack has all the hallmarks of a private company reportedly that works with governments to deliver spyware that takes over the functions of mobile phone operating systems," a WhatsApp spokesperson said in a statement.

While WhatsApp did not name the private company, a source familiar with the investigation into the attack said that company is NSO Group, an Israeli cyber company that has developed a powerful piece of malware designed to spy on its victims.

In a statement provided to CNN on Monday, NSO said, "Under no circumstances would NSO be involved in the operating or identifying of targets of its technology, which is solely operated by intelligence and law enforcement agencies."

NSO said its technology was licensed to government agencies "for the sole purpose of fighting crime and terror," adding that those agencies determine how the technology is used without any involvement from the company.

The Financial Times first reported details of the vulnerability.

Human rights activists targeted?

Among those believed to have been targeted via WhatsApp is a London-based human rights lawyer, who is advising on a case against NSO. NSO has denied targeting the lawyer.

On Sunday, the lawyer received two calls that John Scott-Railton, a senior researcher at the University of Toronto's Citizen Lab believes were part of the attack. Citizen Lab is an academic security research group that investigates digital threats to civil society groups and online freedom of expression.

The apparent attempt to breach the lawyer's phone was not successful, Scott-Railton said, as WhatsApp had patched the vulnerability by Sunday.

Speaking to CNN Business on Tuesday the lawyer, who does not want to be named, said that in March they began receiving suspicious calls on WhatsApp from Swedish, Irish and Icelandic phone numbers.

WhatsApp had reached out to Citizen Lab and a number of other groups that work with human rights defenders before publicly acknowledging the attack.

The collaboration between WhatsApp and Citizen Lab helped identify the attempted attack on the London-based lawyer.

Responding specifically to the apparent targeting of the lawyer, NSO Group said in a statement, "NSO would not or could not use its technology in its own right to target any person or organization, including this individual."

Amnesty International filed a petition at the district court of Tel Aviv on Tuesday demanding Israel withdraw NSO's export license, Amnesty's lawyer told CNN Business.

The group claims that NSO software "threatens the rights to privacy and to freedom of opinion and expression, in breach of Israel's obligations under international human rights law."