WhatsApp have been urging users to update to the latest version following the discovery of a spyware vulnerability within the Facebook-owned app. The security bug allows hackers to take over your phone – just by calling it.
WhatsApp, the popular instant messaging app used by 1.5 billion people worldwide, has recently been made aware of a security vulnerability. Normally when it comes to malware, best practice will protect you. We’ve discovered at length the measures you can take to protect your devices from viruses and other forms of malware – avoiding downloading software from non-legit websites, double-checking links in emails are from a reputable source, and so on. But what’s unique about this newly-discovered piece of spyware is that anyone could be infected, no matter how safe they are with their devices – the user’s phone can be infected through the app’s call function, regardless of whether you answer it or not. To make matters even worse, many infected users are reporting that the call was also hidden from logs, meaning they were none the wiser. All brands of smartphone that can run WhatsApp – including iPhones (and other iOS devices like iPads and iPod Touches), Android phones, Windows phones, and Tizen devices.
WhatsApp has long been heralded as one of the most secure messaging apps, with even governments struggling to break the end-to-end encryption; but this exploit has cast doubts on that. The spyware – known as Pegasus – was developed by an Israeli cyber-intelligence company called NSO. Affecting both WhatsApp and WhatsApp business accounts, Pegasus is one of the largest zero-day bugs of the last few years. A zero-day bug is one in which a cybercriminal exploits a security hole before it is patched, which WhatsApp have now done. But how serious is it if your smartphone gets infected with the Pegasus spyware? Once infected, the Pegasus spyware can access a whole wealth of data on the user’s device, including calls, texts, photos, emails, contacts, GPS location, browser history, and more. In addition, Pegasus can also activate the phone’s microphone and camera.
The Israeli MoD decides who NSO can sell the Pegasus spyware to, and it’s typically limited to state intelligence agencies. Countries like Saudi Arabia and the UAE are known to be in ownership of the software, and Amnesty International is currently supporting legal action to take the Israeli MoD to court, demanding it revokes NSO’s export license. Reportedly, the murdered Saudi journalist Jamal Khashoggi was tracked using the spyware. The Financial Times have reported that WhatsApp became known about the existence of the vulnerability in their messaging app after a UK-based human rights lawyer’s phone was targeted. While the number of affected users is reportedly only in the dozens, protecting your smartphone from the Pegasus spyware is crucial – particularly if it contains sensitive information. Facebook have implemented server-side changes, and pushed out an update across all platforms that WhatsApp and WhatsApp Business are available on.
