Hackers exploited WhatsApp flaw to install spyware
San Francisco: A security flaw in WhatsApp, one of the most popular messaging apps in the world, allowed sophisticated attackers to install spyware on phones, the company said Tuesday, in the latest trouble for its parent Facebook.
The vulnerability -- first reported by the Financial Times, and fixed in the latest WhatsApp update -- allowed hackers to insert malicious software on phones by calling the target using the app, which is used by 1.5 billion people around the world.
The FT cited a spyware dealer as saying the tool was developed by a shadowy Israel-based firm called the NSO Group, which has been accused of helping governments from the Middle East to Mexico snoop on activists and journalists.
Security researchers said the malicious code bore similarities to other tech developed by the firm, according to The New York Times.
The latest exploit -- which impacts Android devices and Apple's iPhones, among others -- was discovered earlier this month and WhatsApp scrambled to fix it, rolling out an update in less than 10 days.
"WhatsApp encourages people to upgrade to the latest version of our app, as well as keep their mobile operating system up to date, to protect against potential targeted exploits designed to compromise information stored on mobile devices," a spokesperson said in a statement to AFP.
The firm did not comment on the number of users affected or who targeted them, and said it had reported the matter to US authorities.
The breach is the latest in a series of issues troubling WhatsApp's parent Facebook, which has faced intense criticism for allowing its users' data to be harvested by research companies and over its slow response to Russia using the platform as a means to spread disinformation during the 2016 US election campaign.
The WhatsApp spyware is sophisticated and "would be available to only advanced and highly motivated actors", the company said, adding that a "select number of users were targeted".
"This attack has all the hallmarks of a private company that works with a number of governments around the world" according to initial investigations, it added, but did not name the firm.
WhatsApp has briefed human rights organizations on the matter, but did not identify them.
The Citizen Lab, a research group at the University of Toronto, said in a tweet it believed an attacker tried to target a human rights lawyer as recently as Sunday using this flaw, but was blocked by WhatsApp.
The NSO Group came to prominence in 2016 when researchers accused it of helping spy on an activist in the United Arab Emirates. Its best-known product is Pegasus, a highly invasive tool that can reportedly switch on a target's phone camera and microphone, and access data on it.
The firm said Tuesday that it only licenses its software to governments for "fighting crime and terror".
The NSO Group "does not operate the system, and after a rigorous licensing and vetting process, intelligence and law enforcement determine how to use the technology to support their public safety missions", it said in a statement to AFP.
"We investigate any credible allegations of misuse and if necessary, we take action, including shutting down the system.
Let the Truth be known. If you read VB and like VB, please be a VB Supporter and Help us deliver the Truth to one and all.
NDA sweeps bypolls to four assembly segments in Bihar
Patna (PTI): The ruling NDA in Bihar on Saturday swept the bypolls to four assembly segments, retaining Imamganj and wresting from the INDIA bloc Tarari, Ramgarh and Belaganj, receiving a boost ahead of the assembly elections due next year.
Candidates of the Jan Suraaj, floated recently by former political strategist Prashant Kishor with much fanfare, lost deposits in all but one seat, in a clear indication that the fledgling party, despite claims of taking the political landscape in the state by storm, needs to cover much ground.
The biggest setback for the INDIA bloc, helmed by the RJD, came in Belaganj, a seat the party had been winning since its inception in the 1990s, but this time lost to the JD(U) headed by Chief Minister Nitish Kumar, the arch-rival of its founding president Lalu Prasad.
The JD(U) candidate Manorama Devi, a former MLC, defeated by a margin of more than 21,000 votes RJD’s Vishwanath Kumar Singh who made his debut from a seat that fell vacant upon election to Lok Sabha of his father Surendra Prasad Yadav, a multiple term MLA.
The margin of victory was greater than the 17,285 votes polled by Mohd Amjad of Jan Suraaj, whom the RJD may have liked to blame for its defeat by causing a split in Muslim votes.
JD(U) national spokesman Rajiv Ranjan Prasad said, "The people of Bihar deserve kudos for rejecting the negativity of the opposition and reposing their trust in Chief Minister Nitish Kumar. Under his leadership, the NDA will win more than 200 seats of the 243-strong assembly in 2025."
The RJD also suffered an embarrassing defeat in Ramgarh, where Prashant Kishor’s prediction of the party “finishing third or fourth” came true. The forecast had caused Sudhakar Singh, son of state RJD president Jagadanand Singh, the MP from Buxar who had won the assembly seat in 2020, to threaten that Jan Suraaj cadres in the constituency will be “beaten up with sticks”.
Singh’s younger brother Ajit finished a distant third after BJP winner Ashok Kumar Singh, a former MLA, and Satish Kumar Singh Yadav who fought on a ticket of the BSP, which has little foothold in Bihar.
Jan Suraaj, though, was hardly a factor in Ramgarh, where its candidate Sushil Kumar Singh polled less than four per cent votes.
The BJP also pulled off a stunning victory in Tarari, which falls under the Arrah Lok Sabha seat, currently represented by CPI(ML)’s Sudama Prasad, who had won the assembly segment for two consecutive terms.
CPI(ML) candidate Raju Yadav lost, by a margin of a little over 10,000 votes, to BJP debutant Vishal Prashant, better known as the son of local strongman Sunil Pandey, who was formerly with the JD(U) and had joined the saffron party a few months ago.
Jan Suraaj had initially announced that it was fielding a former Vice Chief of the Army in Tarari but later disclosed that he could not contest because of technical reasons. Its candidate Kiran Singh got less than four per cent votes.
The most respectable performance from Jan Suraaj came in the reserved Imamganj seat where its candidate Jitendra Paswan stood third, polling well over 20 per cent votes.
The seat, however, went to Deepa Kumari, daughter-in-law of Union minister Jitan Ram Manjhi, who defeated RJD’s Raushan Kumar by a slender margin of less than 6,000 votes.
Manjhi, who heads the Hindustani Awam Morcha, vacated Imamganj earlier this year upon getting elected to Lok Sabha from Gaya.
With the exception of Ashok Singh in Ramgarh, the winners in all the seats shall be making their debut in the state assembly.
