Η WhatsApp filed a lawsuit in federal court accusing an Israeli company (NSO Group) of developing monitoring software which was used hundreds of times for the monitoring of its users.
The lawsuit, filed in federal court in California, states that the Israeli company "developed the malware to gain access to messages and other information after it was encrypted" on the victims' devices.
But the malware worked by exploiting an audio vulnerability-calls that existed in the WhatsApp application code.
Users received a regular call, but the malware infected the device with spyware, giving the attackers full access.
In some cases the infection was so fast, the victim's phone had no complications while loading the spyware.
Because WhatsApp app uses end-to-end encryption, it is almost impossible to access messages as they travel across the internet. But in recent years, various governments and spyware companies have begun targeting the devices where the messages are sent or received. The logic is that if you manage to hack the device, you can get its data.
What does WhatsApp say?
WhatsApp, owned by Facebook, quickly fixed the vulnerability. Although the company blames responsibility on the NSO Group, WhatsApp has not publicly accused the Israeli company until today.
In a post that went up shortly after the lawsuit was filed, Wills Cathcart, the head of WhatsApp, claimed that “the attackers were using servers and services hosting companies that had been used or associated” with the NSO Group and that some WhatsApp accounts used during the attacks were also traced to the Israeli company.
"Although their attack was very sophisticated, their attempts to cover their routes were not entirely successful," Cathcart said.
Overall, it appears that some 1.400 targeted devices have been affected by the hack, according to the lawsuit.
WhatsApp reported that the victims included more than 100 human rights defenders, journalists and "other members of civil society." The targets also included government officials and diplomats.
The NSO Group states: "We dispute the allegations and we will fight for it."
