Facebook Says Israeli Firm Was Involved in Recent WhatsApp Intrusion

Evidence suggests NSO Group used WhatsApps servers to distribute mobile spyware to targeted devices.

Israeli technology firm NSO Group Wednesday strongly denied allegations by Facebook that it had exploited a security flaw in a WhatsApps video-calling feature earlier this year to install surveillance software on mobile devices belonging to some 100 human rights activists, journalists, and others.
Facebook made the claim in a federal complaint filed in US District Court for the Northern District of California this week. In the complaint, the social media giant accused NSO Group of being involved in an intrusion in which WhatsApps servers were used to distribute spyware called Pegasus to some 1,400 targeted devices between April and May.
Facebook described NSOs exploit as giving attackers a way to use WhatsApps systems to make a video call to a target device and install Pegasus on the device without the victim even having to answer the call.
NSO sells tools for fighting cybercrime, terrorism, and other crimes to governments and law enforcement organizations around the world. Some — like researchers at the
Citizen Lab
at the University of Toronto — have warned about NSOs tools, particularly Pegasus, being used widely by governments with poor human rights records to conduct surveillance on ordinary citizens and targets of interest. Citizen Lab has identified at least 45 countries where Pegasus is being used to spy on mobile device users.
Facebook, which owns WhatsApp, had earlier hinted at NSOs involvement in the attack, and others had openly speculated about it despite the Israeli firms strident denials. This weeks federal complaint marks the first time Facebook has come out and formally accused NSO of breaking US computer fraud and abuse statutes.
In an opinion piece in
The Washington Post
on Tuesday, Will Cathcart, vice president of product management at Facebook, said months of investigation had confirmed the companys previous suspicions about NSO Group.
NSO has previously denied any involvement in the attack, stating that under no circumstances would NSO be involved in the operating … of its technology, Cathcart said. But our investigation found otherwise.
Responding to the claim, NSO, which sells cyber and other crime-fighting technology to governments and law enforcement agencies, said its tools are not designed or licensed for use against human rights activists and journalists.
In the strongest possible terms, we dispute todays allegations and will vigorously fight them, the company said via an e-mailed statement to Dark Reading. The sole purpose of NSO is to provide technology to licensed government intelligence and law enforcement agencies to help them fight terrorism and serious crime.
What the Evidence Shows
According to Cathcart, evidence shows the attackers who broke into WhatsApps servers used systems and Internet hosting services that were previously associated with NSO. In addition, certain WhatsApp accounts that were used during the attacks point to NSO as well. While their attack was highly sophisticated, their attempts to cover their tracks were not entirely successful, Cathcart said.
Richard Gold, head of security engineering at Digital Shadows, says Facebooks claim likely rests on multiple, interlocking pieces of evidence. WhatsApp/Facebook would have access to the registration details, which were used when NSO Group signed up for the operational WhatsApp accounts that were used in the attacks, including name, mobile phone numbers, and IP addresses, he said.
While such data can and often is faked, WhatsApp likely had the resources to identify the individuals or entities that were really behind the accounts. Forensic evidence also would have revealed evidence of Pegasus on the compromised devices. Since Pegasus is believed to be only available to NSO Group customers, it is reasonable to claim that its presence on compromised devices was due to previous successful exploitation events, Gold says.
NSO, meanwhile, defended its technology as critical to helping law enforcement agencies track down criminals who take advantage of encrypted services such as WhatsApp to carry out malicious activities. NSOs technologies provide proportionate, lawful solutions to this issue, the company said in its statement.
Any other use of NSO products — particularly those targeting human rights activists and journalists — are contractually prohibited and represent a misuse of the tools, the company said.
Chris Morales, head of security analytics at Vectra, says Facebooks evidence is likely based on origination of traffic and accounts. The argument will be, who was accountable on the other end of those accounts and who sanctioned the operation of spying?
Related Content:
Commercial Spyware Uses WhatsApp Flaw to Infect Phones
Former NSO Group Employee Steals, Sells Spy Tools
Mobile Users Targeted With Malware, Tracked by Advertisers
8 Tips for More Secure Mobile Computing
This free, all-day online conference offers a look at the latest tools, strategies, and best practices for protecting your organization’s most sensitive data. Click for
more information
and, to register,
here
.

Last News
▸ Scan suggests Heartbleed patches may not have been successful. ◂ Discovered: 23/12/2024 Category: security	▸ IoT Devices on Average Have 25 Vulnerabilities ◂ Discovered: 23/12/2024 Category: security	▸ DHS-funded SWAMP scans code for bugs. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Facebook Says Israeli Firm Was Involved in Recent WhatsApp Intrusion