How would you know if you were living in a dystopia? Maybe when an entirely legal company sells spyware to governments that is capable of infecting one of the world’s most popular communication tools – with nothing more than a phone call. This is the apparent reality of the WhatsApp spyware scandal, and it’s oh so cyberpunk.
News of the security flaw and exploit broke late yesterday, and one of the first reactions from cybersecurity experts was to point out how sophisticated it is.
Go deeper with GlobalData
It works by sending a voice call over WhatsApp that includes manipulated data packets that are designed to overflow a buffer built into the app. This leads to other parts of the app’s memory being overwritten, providing a gateway not only to the user’s encrypted conversations, but other data on the phone, including files, photos, contacts and calls.
Incredibly, for all this to happen the user doesn’t even need to answer the call: their phone just needs to be on. And afterwards, the spyware can modify their WhatsApp call history, removing any evidence of its presence.
“The attack on WhatsApp is based on using a bug in the code to give the attackers control over what it does,” said Winston Bond, EMEA senior technical director at Arxan.
“It takes a lot of research and reverse engineering to create an attack like that.”
How well do you really know your competitors?
Access the most comprehensive Company Profiles on the market, powered by GlobalData. Save hours of research. Gain competitive edge.
Thank you!
Your download email will arrive shortly
Not ready to buy yet? Download a free sample
We are confident about the unique quality of our Company Profiles. However, we want you to make the most beneficial decision for your business, so we offer a free sample that you can download by submitting the below form
By GlobalDataOn face value, the WhatsApp spyware sounds like the work of a sophisticated cybercriminal organisation, likely backed by a nation state – a common trend in the world of cybersecurity. But the truth appears to be far stranger.
The creators of the tool have been named by the Financial Times as NSO Group – an Israeli company that develops spyware technology for governments. It’s even got a brand name: Pegasus.
Pegasus and the NSO Group: the tool behind the WhatsApp spyware scandal
Much like the developers of military hardware, NSO Group builds tools to assist with entirely legal – albeit potentially controversial – efforts, marketing its products for use in online operations against criminals and terrorists.
Pegasus is one such tool, and it has been sold in various forms to governments for the last decade. Only the latest version has WhatsApp targeting in its arsenal, a capability that according to the Financial Times was described by NSO Group sales people as “great from a sales point”.
Notably, this indicates that while all WhatsApp users are at risk until they install the update rolled out by owner Facebook over the weekend, it does suggest that the vast majority of people will not be targeted by Pegasus.
“Since this Zero day is attributed by the researchers to the NSO Group, it’s likely used surgically, only against specific people of interest and not as a mass infection payload,” said Assaf Dahan, senior director, head of threat research at Cybereason.
“Assuming that the latest version published by WhatsApp fixes the buffer overflow vulnerability, users who install the latest version will be protected.”
But key to the current scandal is the fact that the tool has been found on the phones of a variety of individuals that are neither terrorists nor criminals, including human rights activists and journalists.
NSO Group stresses that it has no involvement in who its tools are used against – that is entirely up to the governments in question – and that it carefully vets its customers. But not everyone believes this is the case.
A staff member for Amnesty International is among those who have been infected with Pegasus, prompting fury from the human rights organisation.
“NSO Group sells its products to governments who are known for outrageous human rights abuses, giving them the tools to track activists and critics,” said Danna Ingleton, deputy director of Amnesty Tech. “The attack on Amnesty International was the final straw.”
“While it’s less likely that the average citizen would be targeted with this kind of spyware, WhatsApp is used by many people for whom the privacy of their conversations is a life and death matter,” added Tim Erlin, VP, product management and strategy at Tripwire.
The dystopian reality of government cybersecurity tools
For many the notable aspect of the saga will be that a popular tool for secure communications has such a notable security flaw. And certainly for WhatsApp, which is widely known for its use of end-to-end encryption, this will present a challenge to consumer confidence.
“It’s comforting to see that WhatsApp has acted so quickly to roll out a fix, but for a business that has hinged so much of its marketing strategy on its security capabilities, this attack will worry its customer base,” said Wai Man Yau, vice president and general manager international at Sonatype.
“The messaging app claims that it offers ‘security by default’, but for it to be genuinely secure – and GDPR compliant – it must also offer security by design, and ensure that it prioritises software security as much as its encryption capabilities.”
However, the fact that it has been exploited by a commercially available tool routinely being sold to governments is arguably a far greater concern, because it reveals a reality truly worthy of a William Gibson novel: government surveillance isn’t just a reality, it’s a reality dominated by corporate interests.
The illusion of online security provided by products such as WhatsApp hasn’t just been shattered: it’s been shattered by an organisation acting in a completely legal manner, entirely for profit.
And while NSO Group says it is selective about its customers, as an organisation motivated by making a sale, its first priority is never going to be the prevention of human rights abuses.
Read more: Facebook WhatsApp merger has serious privacy implications for users
