WhatsApp today disclosed a vulnerability that allowed hackers to remotely exploit a bug in the app's audio call system to access sensitive information on an iPhone or Android device.
According to The New York Times, attackers were able to insert malicious code into WhatsApp, allowing them to steal data, regardless of whether or not a WhatsApp phone call was answered.
Security researchers said that the spyware that took advantage of this flaw featured characteristics of the Pegasus spyware from NSO Group, which is normally licensed to governments who purchase the spyware for installing on the devices of individuals who are the target of an investigation.
Description:A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of SRTCP packets sent to a target phone number.The vulnerability was described by WhatsApp as "nontrivial to deploy, limiting it to advanced and highly motivated actors," but it's not clear how long the security flaw was available nor how many people were affected. It was used to target a London lawyer who has been involved in lawsuits against the NSO Group, and security researchers believe others could have been targeted as well.
Affected Versions: The issue affects WhatsApp for Android prior to v2.19.134, WhatsApp Business for Android prior to v2.19.44, WhatsApp for iOS prior to v2.19.51, WhatsApp Business for iOS prior to v2.19.51, WhatsApp for Windows Phone prior to v2.18.348, and WhatsApp for Tizen prior to v2.18.15.
WhatsApp engineers "worked around the clock" to address the vulnerability, and made a patch available on Monday. The initial vulnerability was discovered ten days ago after WhatsApp found abnormal voice calling activity following complaints from the aforementioned lawyer. WhatsApp says that it has notified the Department of Justice and a "number of human rights organizations" about the issue.
Update: Reader comments suggested that some of the wording in this article was confusing or misleading, so we have updated it to make sure the details of the vulnerability are clear. Specifically, this issue impacted WhatsApp, not the iOS operating system.
Note: Due to the political nature of the discussion regarding this topic, the discussion thread is located in our Politics, Religion, Social Issues forum. All forum members and site visitors are welcome to read and follow the thread, but posting is limited to forum members with at least 100 posts.
Tag: WhatsApp
51 comments
The United States Justice Department is launching a broad antitrust review into whether major technology companies are unlawfully stifling competition, reports The Wall Street Journal.
The DoJ...
Apple this week released iOS 12.4, the newest version of iOS 12 available for iPhones and iPads. One of the new features in iOS 12.4 is an updated data migration option that uses device to device...
Apple's mobile apps are often first in App Store search results ahead of competitors, according to a new analysis done by The Wall Street Journal.
For basic searches like "maps,"...
Apple plans to release an all-new 16-inch MacBook Pro in October, according to supply chain sources cited by Taiwan's Economic Daily News.
The report claims the 16-inch display will be a...
Apple is widely expected to unveil a trio of new iPhones in September, and 9to5Mac has revealed a few new features we can expect.
First, the report claims all three models will feature a...
Apple earlier this month introduced a surprise update to its MacBook Pro line, overhauling the entry-level 13-inch machine to bring it in line with more expensive models that were updated back in...
Apple is now in advanced talks to purchase Intel's smartphone modem chip business, reports The Wall Street Journal, citing people familiar with Apple's plans.
A deal that covers a...
Apple's iPhone XR was the best selling iPhone in the third fiscal quarter of 2019, according to new data shared today by Consumer Intelligence Research Partners (CIRP).
The iPhone XS, iPhone...
