On Tuesday, WhatsApp scored a major victory against NSO Group , when a court ordered the spying company to pay more than $167 million in damages to its company Meta.
The decision ended a legal battle that lasted more than five years, after it began in October 2019, when WhatsApp accused NSO Group of hacking more than 1.400 of its users by exploiting a security flaw in the chat app's audio calling functionality.
The verdict came after a week-long jury trial, which included several testimonies, including from NSO Group CEO Yaron Shohat, as well as WhatsApp employees who investigated the incident.
Even before the trial began, several details had been revealed, such as that NSO Group had excluded 10 of its government customers for abusing the Pegasus spyware, as well as the names of three of the company's customers: Mexico, Saudi Arabia, and Uzbekistan.
TechCrunch read the transcripts of the trial hearings and reports on the most interesting facts and revelations that came to light.
Testimonies described how the WhatsApp attack worked
The zero-click attack, meaning the spyware required no interaction from the target, “operated by making a fake WhatsApp phone call to the target,” WhatsApp lawyer Antonio Perez said during the trial.
The lawyer explained that NSO Group had built what it called a “WhatsApp Installation Server,” a special machine designed to send malicious messages to WhatsApp’s infrastructure, imitating real messages.
"Once received, these messages would activate the user's phone and tell them to contact a third-party server to download the Pegasus spyware. All they needed to make this happen was the phone number," Perez said.
NSO Group: confirmed that it targeted a US number as a test for the FBI
For years, NSO Group has claimed that its spyware cannot be used against American phone numbers, that is, any mobile number that starts with a +1 country code.
In 2022, the New York Times first reported that the company had “hacked” an American phone, but it was part of a test for the FBI.
NSO Group lawyer Joe Akrotirianakis (yes, Greek surname), confirmed this, saying that the “sole exception” of Pegasus targeting +1 numbers “was a specially configured version of Pegasus that could be used for demonstration to potential US government customers.”
The FBI reportedly chose not to use Pegasus after testing it.
How do NSO Group's government customers use Pegasus?
NSO CEO Shohat explained that Pegasus' user interface for its government customers did not provide options for the hacking method or technique to be used against the targets of their interest, "because customers are not interested in which exploit to use, but in getting the information they need."
In other words, the Pegasus system in the backend chooses on its own which hacking technology (which exploit) will be used each time the spyware targets an individual.
NSO Group headquarters shares the same building with Apple
In a funny coincidence, NSO Group's headquarters in Herzliya, a suburb of Tel Aviv in Israel, is in the same building as Apple, whose iPhone customers have also been frequently targeted by NSO's Pegasus spyware. Shohat said NSO occupies the top five floors and Apple the rest of a 14-story building.
NSO Group admitted that it continued to target WhatsApp users after the lawsuit was filed.
Following the spyware attack, WhatsApp filed a lawsuit against NSO Group in November 2019. Despite active legal action, the spyware maker continued to target users of the app, according to NSO Group's vice president of research and development, Tamir Gazneli.
Gazneli said that “Erised,” the codename for one of the versions of WhatsApp’s zero-click malware, was used from late 2019 to May 2020. The other versions were called “Eden” and “Heaven,” and the three were collectively known as “Hummingbird.”
Although the press releases will range from very select to rare, I said I'd pass...because sometimes the editors hide.
