Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Application Security

10/30/2019
03:45 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Facebook Says Israeli Firm Was Involved in Recent WhatsApp Intrusion

Evidence suggests NSO Group used WhatsApps servers to distribute mobile spyware to targeted devices.

Israeli technology firm NSO Group Wednesday strongly denied allegations by Facebook that it had exploited a security flaw in a WhatsApp's video-calling feature earlier this year to install surveillance software on mobile devices belonging to some 100 human rights activists, journalists, and others.

Facebook made the claim in a federal complaint filed in US District Court for the Northern District of California this week. In the complaint, the social media giant accused NSO Group of being involved in an intrusion in which WhatsApp's servers were used to distribute spyware called Pegasus to some 1,400 targeted devices between April and May.

Facebook described NSO's exploit as giving attackers a way to use WhatsApp's systems to make a video call to a target device and install Pegasus on the device without the victim even having to answer the call.

NSO sells tools for fighting cybercrime, terrorism, and other crimes to governments and law enforcement organizations around the world. Some — like researchers at the Citizen Lab at the University of Toronto — have warned about NSO's tools, particularly Pegasus, being used widely by governments with poor human rights records to conduct surveillance on ordinary citizens and targets of interest. Citizen Lab has identified at least 45 countries where Pegasus is being used to spy on mobile device users.

Facebook, which owns WhatsApp, had earlier hinted at NSO's involvement in the attack, and others had openly speculated about it despite the Israeli firm's strident denials. This week's federal complaint marks the first time Facebook has come out and formally accused NSO of breaking US computer fraud and abuse statutes.

In an opinion piece in The Washington Post on Tuesday, Will Cathcart, vice president of product management at Facebook, said months of investigation had confirmed the company's previous suspicions about NSO Group.

"NSO has previously denied any involvement in the attack, stating that 'under no circumstances would NSO be involved in the operating … of its technology,'" Cathcart said. "But our investigation found otherwise."  

Responding to the claim, NSO, which sells cyber and other crime-fighting technology to governments and law enforcement agencies, said its tools are not designed or licensed for use against human rights activists and journalists. 

"In the strongest possible terms, we dispute today's allegations and will vigorously fight them," the company said via an e-mailed statement to Dark Reading. "The sole purpose of NSO is to provide technology to licensed government intelligence and law enforcement agencies to help them fight terrorism and serious crime."

What the Evidence Shows
According to Cathcart, evidence shows the attackers who broke into WhatsApp's servers used systems and Internet hosting services that were previously associated with NSO. In addition, certain WhatsApp accounts that were used during the attacks point to NSO as well. "While their attack was highly sophisticated, their attempts to cover their tracks were not entirely successful," Cathcart said.

Richard Gold, head of security engineering at Digital Shadows, says Facebook's claim likely rests on multiple, interlocking pieces of evidence. "WhatsApp/Facebook would have access to the registration details, which were used when NSO Group signed up for the operational WhatsApp accounts that were used in the attacks, including name, mobile phone numbers, and IP addresses," he said.

While such data can and often is faked, WhatsApp likely had the resources to identify the individuals or entities that were really behind the accounts. Forensic evidence also would have revealed evidence of Pegasus on the compromised devices. "Since Pegasus is believed to be only available to NSO Group customers, it is reasonable to claim that its presence on compromised devices was due to previous successful exploitation events," Gold says.

NSO, meanwhile, defended its technology as critical to helping law enforcement agencies track down criminals who take advantage of encrypted services such as WhatsApp to carry out malicious activities. "NSO's technologies provide proportionate, lawful solutions to this issue," the company said in its statement.

Any other use of NSO products — particularly those targeting human rights activists and journalists — are contractually prohibited and represent a misuse of the tools, the company said.

Chris Morales, head of security analytics at Vectra, says Facebook's evidence is likely based on origination of traffic and accounts. "The argument will be, who was accountable on the other end of those accounts and who sanctioned the operation of spying?"

Related Content:

This free, all-day online conference offers a look at the latest tools, strategies, and best practices for protecting your organization’s most sensitive data. Click for more information and, to register, here.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Where Are the 'Great Exits' in the Data Security Market?
Dave Cole, Cofounder and CEO, Open Raven,  10/13/2020
Overcoming the Challenge of Shorter Certificate Lifespans
Mike Cooper, Founder & CEO of Revocent,  10/15/2020
US Counterintelligence Director & Fmr. Europol Leader Talk Election Security
Kelly Sheridan, Staff Editor, Dark Reading,  10/16/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-4564
PUBLISHED: 2020-10-20
IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.0.3.1 and IBM Sterling File Gateway 2.2.0.0 through 6.0.3.1 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially lea...
CVE-2020-4748
PUBLISHED: 2020-10-20
IBM Spectrum Scale 5.0.0 through 5.0.5.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 188517.
CVE-2020-4749
PUBLISHED: 2020-10-20
IBM Spectrum Scale 5.0.0 through 5.0.5.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link ...
CVE-2020-4755
PUBLISHED: 2020-10-20
IBM Spectrum Scale 5.0.0 through 5.0.5.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 188595.
CVE-2020-4756
PUBLISHED: 2020-10-20
IBM Spectrum Scale V4.2.0.0 through V4.2.3.23 and V5.0.0.0 through V5.0.5.2 as well as IBM Elastic Storage System 6.0.0 through 6.0.1.0 could allow a local attacker to invoke a subset of ioctls on the device with invalid arguments that could crash the keneral and cause a denial of service. IBM X-For...