Hackers discovered a flaw in WhatsApp’s software that allowed the installation of spyware on cellphones through voice calls, the company admitted to the Financial Times on Monday.
Engineers worked around the clock from Friday to Monday to develop a fix for the security loophole discovered earlier this month.
“This attack has all the hallmarks of a private company known to work with governments to deliver spyware that reportedly takes over the functions of mobile phone operating systems,” the company told Financial Times. “We have briefed a number of human rights organizations to share the information we can, and to work with them to notify civil society.”
WhatsApp, owned by Facebook, is a popular communications platform used by individuals, as well as businesses and governments around the world. It’s been hailed for its end-to-end encryption.
Who are the hackers?
The application’s vulnerability allegedly allowed Israeli-based NSO Group’s targeted spyware to install itself through voice calls on both iOS and Android devices whether the user answered the infected call or not.
A buffer overflow weakness permitted malicious code to be inserted into the data packets when users started a voice call.
Coincidentally, Amnesty International announced on Monday, that it “is supporting a legal action to take the Israeli Ministry of Defense (MoD) to court, to demand that it revokes the export license of NSO Group, an Israeli company whose spyware products have been used in chilling attacks on human rights defenders around the world.”
Amnesty said it would file a petition on Tuesday in the District Court of Tel Aviv.
“[A]pproximately 30 members and supporters of Amnesty International Israel and others from the human rights community set out how the MoD has put human rights at risk by allowing NSO to continue exporting its products,” the organization said in a release.
“NSO Group sells its products to governments who are known for outrageous human rights abuses, giving them the tools to track activists and critics,” said Danna Ingleton, deputy director of Amnesty Tech.
Which versions of WhatsApp were affected?
Multiple versions of the app were affected, according to Facebook.
The issue affects WhatsApp for Android prior to v2.19.134, WhatsApp Business for Android prior to v2.19.44, WhatsApp for iOS prior to v2.19.51, WhatsApp Business for iOS prior to v2.19.51, WhatsApp for Windows Phone prior to v2.18.348, and WhatsApp for Tizen prior to v2.18.15,” Facebook told Forbes.
It’s not immediately clear how many of the app’s 1.5 billion users were affected but a WhatsApp spokesperson told the Financial Times that “a number in the dozens would not be inaccurate.”
What should WhatsApp users do now?
Users should update their apps to the latest version, which was released Monday.
“We encourage people to upgrade to the latest version of our app, as well as keep their mobile operating system up-to-date, to protect against potential targeted exploits designed to compromise information stored on mobile devices,” WhatsApp told Forbes in a statement.