Global users of the messaging platform, WhatsApp, have been urged to update the app immediately, after it was discovered to have been hacked using technology created by an Israeli company that sells technology exploits to governments, allowing them to spy on individual devices.
It’s not clear how successful and wide-spread the attack has been, but it appears to have already been used on numerous target phones.
The exploited flaw in WhatsApp allows the app to be hacked by simply leaving a missed call on a target’s phone. Until the update was released there was nothing a user could do to counteract it. Once hit with a missed call from an unknown number, the affected phone would be compromised without the user’s knowledge.
The Independent newspaper has reported that a fix-update is now available for all major platforms with security experts urging all users to ensure their phones are up to date as soon as they can. It is important to check that your phone has the right version, which will show alongside the update. On iOS, it should be version 2.19.51, and on Android it needs to be 2.19.134 or later.
A spokesperson for WhatsApp said: “The spyware was created by an ‘advanced cyber actor’ and has already been used on multiple phones”.
In a brief description of the issue, WhatsApp’s owner, Facebook, states that a buffer overflow vulnerability in WhatsApp’s VOIP stack allowed remote code execution via a specially crafted series of SRTCP packets sent to a target phone number.
The Financial Times identified the actor as Israel’s NSO Group, and a WhatsApp spokesman commented on this saying: “We’re certainly not refuting any of the coverage you’ve seen”. The NSO said in a statement that it provides spying technology to government agencies, and that it does not use it itself.
The WhatsApp spokesman went on to further state the attack had “all the hallmarks of a private company that has been known to work with governments to deliver spyware that has the ability to take over mobile phone operating systems”.