Vulnerability: Whatsapp
|by Alpha Team
On May 13 2019, The Guardian reported that WhatsApp has a vulnerability which allows for malicious software to be run on a user's phone. The malicious software can be automatically installed by merely calling a user. Perhaps even more insidious is that the call log on the user's phone is cleared so that no evidence remains of the caller that initiated the attack. WnatsApp has released a version of the software which fixes this bug.
Recommendations
- Update the the latest version of WhatsApp
- Ensure phone antivirus software is up to date with the latest signatures
Details
WhatsApp is encouraging users to update to the latest application version due to a flaw in their software. Namely, a vulnerability was discovered which allowed a malicious user to inject malware onto a call recipient's device. Perhaps most alarmingly, the user is not required to answer the call to be infected and once infected, the malware gets rid of the incoming call logs, making it difficult to tell if a user has been targeted. WhatsApp has corrected the issue and released an update version of their application.
The organization that created the software, the NSO Group claims that their software, Pegasus is incapable of causing harm on its own and requires an attack vector to target a given user. Furthermore, they claim that they only sell to state intelligence agencies. However, given the attack surface and potential for exploitation, WhatsApp has briefed human rights organizations about the potential for abuse.
Tags: communications, global, vulnerability/exploit