Spyware crafted by a sophisticated group of hackers-for-hire took advantage of a flaw in the popular WhatsApp communications program to remotely hijack dozens of phones, the company said late Monday.
The Financial Times identified the actor as Israel’s NSO Group, and WhatsApp all but confirmed the identification, describing hackers as “a private company that has been known to work with governments to deliver spyware.” A spokesman for the Facebook subsidiary later said: “We’re certainly not refuting any of the coverage you’ve seen.”
The malware was able to penetrate phones through missed calls alone via the app’s voice calling function, the spokesman said. An unknown number of people — an amount in the dozens at least would not be inaccurate — were infected with the malware, which the company discovered in early May, said the spokesman, who was not authorized to be quoted by name.
John Scott-Railton, a researcher with the internet watchdog Citizen Lab, called the hack “a very scary vulnerability.”
“There’s nothing a user could have done here, short of not having the app,” he said.
The spokesman said the flaw was discovered while “our team was putting some additional security enhancements to our voice calls” and that engineers found that people targeted for infection “might get one or two calls from a number that is not familiar to them. In the process of calling, this code gets shipped.”
[…]
