A previously undiscovered flaw in the WhatsApp messaging application allowed an attacker to target human rights activists and lawyers by compromising mobile phones and installing commercial-grade spyware just by making a call, Facebook and independent researchers stated on Tuesday.
A variety of government agencies, security companies, and digital rights activists warned WhatsApps users of the seriousness of the issue, although users have been protected since the Facebook subsidiary blocked the attack vector on the network late last week, the company said in a statement. WhatsApp briefed several human rights organizations on the attack over the past few days.
"We believe a select number of users were targeted through this vulnerability by an advanced cyber actor," the company said. "The attack has all the hallmarks of a private company reportedly that works with governments to deliver spyware that takes over the functions of mobile phone operating systems."
The attack shows the dangers of zero-day vulnerabilities, which are often sold to private companies and government agencies. The current exploit appears to be part of a spyware program called Pegasus, developed by Israeli cyber-offense firm NSO Group and sold to governments for surveillance purposes. The NSO Group, and other offensive tool providers, incorporate exploits for undiscovered security issues into their attack tools to give their customers the ability to hack into the technology used by targeted citizens and companies.
The University of Toronto's Citizen Lab, a ..
Support the originator by clicking the read the rest link below.
