UPDATE
WhatsApp is urging users to update as soon as possible, after a zero-day vulnerability found in its messaging platform was exploited by attackers who were able to inject spyware onto victims’ phones in targeted campaigns.
First reported by the Financial Times, the popular messaging app discovered in early May that attackers were installing surveillance software on iPhones and Android phones – by calling victims using WhatsApp’s call function. WhatsApp is owned by Facebook and is used by 1.5 billion people globally. The messaging platform touts itself as a secure end-to-end encryption app for communications.
“WhatsApp encourages people to upgrade to the latest version of our app, as well as keep their mobile operating system up to date, to protect against potential targeted exploits designed to compromise information stored on mobile devices,” a WhatsApp spokesperson said via email to Threatpost. “We are constantly working alongside industry partners to provide the latest security enhancements to help protect our users.”
A WhatsApp advisory confirmed Monday that the flaw – now patched – is a buffer overflow vulnerability in WhatsApp’s VOIP stack, which allows remote code execution via specially crafted series of SRTCP [Secure Real Time Transport Protocol] packets sent to a target phone number.
Vulnerability Technical Details
In a Tuesday patch analysis, Check Point researchers took a closer look at the vulnerability, CVE-2019-3568 and subsequent fix.
Upon closer look, researchers said that they found two code fixes in the SRTCP module. These were essentially sanitation checks against memory overflows when parsing and handling the network packets in memory.
“WhatsApp implemented their own implementation of the complex SRTCP protocol, and it is implemented in native code, i.e. C/C++ and not Java,” researchers said. “As the entire SRTCP module is pretty big, there could be additional patches that we’ve missed. In addition, judging by the nature of the fixed vulnerabilities and by the complexity of the mentioned module, there is also a probable chance that there are still additional unknown parsing vulnerabilities in this module.”
WhatsApp also said that a patch was released on Monday; and late last week the company made changes to its infrastructure to deny the ability for this attack to take place.
“The attack has all the hallmarks of a private company reportedly that works with governments to deliver spyware that takes over the functions of mobile phone operating systems,” a WhatsApp spokesperson said in a statement.
While WhatsApp did not specify the “private company,” the report by the Financial Times said that the malicious spyware code was developed by the NSO Group, which is known for creating surveillance code.
NSO Group
The NSO Group did not respond to a request for comment from Threatpost. However, in a statement to the BBC, the company said: “NSO’s technology is licensed to authorised government agencies for the sole purpose of fighting crime and terror… Under no circumstances would NSO be involved in the operating or identifying of targets of its technology, which is solely operated by intelligence and law enforcement agencies. NSO would not or could not use its technology in its own right to target any person or organisation.”
However, the news has led to heightened criticism of the NSO Group, particularly because the group has been at the center of controversy in the past for the development of the infamous Pegasus spyware, which has been used to target iPhones and Android phones of government dissidents, human rights activists and more globally. According to a report by Cyberscoop, an array of human rights groups plan to file a petition in Israeli court, Tuesday, to revoke NSO’s export license, which would bar the export transaction of the company’s products.
One such human rights group, Amnesty International, said in a Monday statement that its own staff members have been targeted by Pegasus spyware – and that “NSO Group has… refused to accept responsibility or provide remedies for the multiple reported instances of misuse of its surveillance technologies.”
“Last August, an Amnesty staff member received a WhatsApp message in Arabic with a link claiming to be about a protest outside the Saudi Arabian embassy in Washington DC, sent when Amnesty was campaigning for the release of jailed Saudi women activists,” according to the Monday release. “In a petition to be filed tomorrow (14 May) at the District Court of Tel Aviv, Amnesty Israel and other groups will show how the Israeli [Ministry of Defense] has put human rights at risk by allowing NSO to export its products. ”
Victims Targeted
In particular, privacy experts, such as Citizen Lab, are concerned that attackers could target journalists and human rights lawyers. In fact, Citizen Lab said in a Monday tweet: “We believe an attacker tried (and was blocked by WhatsApp) to exploit it as recently as yesterday to target a human rights lawyer.”
WhatsApp has just pushed out updates to close a vulnerability. We believe an attacker tried (and was blocked by WhatsApp) to exploit it as recently as yesterday to target a human rights lawyer. Now is a great time to update your WhatsApp software https://t.co/pJvjFMy2aw https://t.co/e8VQUraZWQ
— Citizen Lab (@citizenlab) May 13, 2019
“This new type of attack is deeply worrying and shows how even the most trusted mobile apps and platforms can be vulnerable,” said Mike Campin, VP of engineering at Wandera, in an email. ” While WhatsApp is not typically used as an official corporate messaging application, it is used widely internationally on both employees’ personal devices as well as on corporate-issued devices, and once exploited via this new attack, the attacker has complete control and visibility of all data on the phone.”
What We Still Don’t Know
While WhatsApp has confirmed the vulnerability and an exploit of the flaw, no further details have been specified by the company regarding the attacks. That includes:
- The timeline and scope of the attacks and who was specifically targeted – Who was targeted? How many victims have there been and for how long has the spyware been on their devices?
- Who was behind the attack – while a “private company” was referenced, there is no reference regarding any governments or other attackers who could have also been using the spyware developed by that “private company” to launch the attacks.
- What the spyware is capable of – there is no further indication about what the attackers’ motives were, and how the spyware is being used specifically to collect data on victims.
How to Update
The issue affects WhatsApp for Android prior to v2.19.134, WhatsApp Business for Android prior to v2.19.44, WhatsApp for iOS prior to v2.19.51, WhatsApp Business for iOS prior to v2.19.51, WhatsApp for Windows Phone prior to v2.18.348, and WhatsApp for Tizen prior to v2.18.15.
Security experts are urging WhatsApp users to update their apps as soon as possible: “Our best suggestion at the moment is to make sure your WhatsApp is up to date,” Kaspersky Lab researchers said in a Tuesday post. “To do that, go to the Apple App Store or Google Play Store, look for WhatsApp and hit Update. If there’s no ‘Update’ button, but you see the ‘Open’ button instead, that means you have the latest version of WhatsApp, and it is already patched against such attacks.”
This article was updated on May 14 at 9:30 a.m. after Synopsys redacted a statement made regarding the WhatsApp incident; as well as to reflect a WhatsApp statement.
Want to know more about Identity Management and navigating the shift beyond passwords? Don’t miss our Threatpost webinar on May 29 at 2 p.m. ET. Join Threatpost editor Tom Spring and a panel of experts as they discuss how cloud, mobility and digital transformation are accelerating the adoption of new Identity Management solutions. Experts discuss the impact of millions of new digital devices (and things) requesting access to managed networks and the challenges that follow.
