Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Application Security

10/30/2019
03:45 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Facebook Says Israeli Firm Was Involved in Recent WhatsApp Intrusion

Evidence suggests NSO Group used WhatsApps servers to distribute mobile spyware to targeted devices.

Israeli technology firm NSO Group Wednesday strongly denied allegations by Facebook that it had exploited a security flaw in a WhatsApp's video-calling feature earlier this year to install surveillance software on mobile devices belonging to some 100 human rights activists, journalists, and others.

Facebook made the claim in a federal complaint filed in US District Court for the Northern District of California this week. In the complaint, the social media giant accused NSO Group of being involved in an intrusion in which WhatsApp's servers were used to distribute spyware called Pegasus to some 1,400 targeted devices between April and May.

Facebook described NSO's exploit as giving attackers a way to use WhatsApp's systems to make a video call to a target device and install Pegasus on the device without the victim even having to answer the call.

NSO sells tools for fighting cybercrime, terrorism, and other crimes to governments and law enforcement organizations around the world. Some — like researchers at the Citizen Lab at the University of Toronto — have warned about NSO's tools, particularly Pegasus, being used widely by governments with poor human rights records to conduct surveillance on ordinary citizens and targets of interest. Citizen Lab has identified at least 45 countries where Pegasus is being used to spy on mobile device users.

Facebook, which owns WhatsApp, had earlier hinted at NSO's involvement in the attack, and others had openly speculated about it despite the Israeli firm's strident denials. This week's federal complaint marks the first time Facebook has come out and formally accused NSO of breaking US computer fraud and abuse statutes.

In an opinion piece in The Washington Post on Tuesday, Will Cathcart, vice president of product management at Facebook, said months of investigation had confirmed the company's previous suspicions about NSO Group.

"NSO has previously denied any involvement in the attack, stating that 'under no circumstances would NSO be involved in the operating … of its technology,'" Cathcart said. "But our investigation found otherwise."  

Responding to the claim, NSO, which sells cyber and other crime-fighting technology to governments and law enforcement agencies, said its tools are not designed or licensed for use against human rights activists and journalists. 

"In the strongest possible terms, we dispute today's allegations and will vigorously fight them," the company said via an e-mailed statement to Dark Reading. "The sole purpose of NSO is to provide technology to licensed government intelligence and law enforcement agencies to help them fight terrorism and serious crime."

What the Evidence Shows
According to Cathcart, evidence shows the attackers who broke into WhatsApp's servers used systems and Internet hosting services that were previously associated with NSO. In addition, certain WhatsApp accounts that were used during the attacks point to NSO as well. "While their attack was highly sophisticated, their attempts to cover their tracks were not entirely successful," Cathcart said.

Richard Gold, head of security engineering at Digital Shadows, says Facebook's claim likely rests on multiple, interlocking pieces of evidence. "WhatsApp/Facebook would have access to the registration details, which were used when NSO Group signed up for the operational WhatsApp accounts that were used in the attacks, including name, mobile phone numbers, and IP addresses," he said.

While such data can and often is faked, WhatsApp likely had the resources to identify the individuals or entities that were really behind the accounts. Forensic evidence also would have revealed evidence of Pegasus on the compromised devices. "Since Pegasus is believed to be only available to NSO Group customers, it is reasonable to claim that its presence on compromised devices was due to previous successful exploitation events," Gold says.

NSO, meanwhile, defended its technology as critical to helping law enforcement agencies track down criminals who take advantage of encrypted services such as WhatsApp to carry out malicious activities. "NSO's technologies provide proportionate, lawful solutions to this issue," the company said in its statement.

Any other use of NSO products — particularly those targeting human rights activists and journalists — are contractually prohibited and represent a misuse of the tools, the company said.

Chris Morales, head of security analytics at Vectra, says Facebook's evidence is likely based on origination of traffic and accounts. "The argument will be, who was accountable on the other end of those accounts and who sanctioned the operation of spying?"

Related Content:

This free, all-day online conference offers a look at the latest tools, strategies, and best practices for protecting your organization’s most sensitive data. Click for more information and, to register, here.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
Data Leak Week: Billions of Sensitive Files Exposed Online
Kelly Jackson Higgins, Executive Editor at Dark Reading,  12/10/2019
Lessons from the NSA: Know Your Assets
Robert Lemos, Contributing Writer,  12/12/2019
4 Tips to Run Fast in the Face of Digital Transformation
Shane Buckley, President & Chief Operating Officer, Gigamon,  12/9/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-19807
PUBLISHED: 2019-12-15
In the Linux kernel before 5.3.11, sound/core/timer.c has a use-after-free caused by erroneous code refactoring, aka CID-e7af6307a8a5. This is related to snd_timer_open and snd_timer_close_locked. The timeri variable was originally intended to be for a newly created timer instance, but was used for ...
CVE-2014-8650
PUBLISHED: 2019-12-15
python-requests-Kerberos through 0.5 does not handle mutual authentication
CVE-2014-3536
PUBLISHED: 2019-12-15
CFME (CloudForms Management Engine) 5: RHN account information is logged to top_output.log during registration
CVE-2014-3643
PUBLISHED: 2019-12-15
jersey: XXE via parameter entities not disabled by the jersey SAX parser
CVE-2014-3652
PUBLISHED: 2019-12-15
JBoss KeyCloak: Open redirect vulnerability via failure to validate the redirect URL.