WhatsApp’s security flaw allowed attackers to install spyware on phones with a single missed call, company urges users to update the app

A security vulnerability in Facebook-owned WhatsApp’s voice calls allows attackers to install commercial Israeli spyware on phones, the company and a spyware dealer told Financial Times that first reported the flaw.

According to FT’s report, the attackers were able to install the surveillance software on iOS and Android phones by calling anyone on WhatsApp. The spyware that’s developed by Israel-based NSO Group could be installed without the users answering these calls, a spyware dealer who was recently briefed on the WhatsApp hack, said, speaking to Financial Times.

A report by The Verge also confirmed that the spyware could be installed without trace and without the target answering the call. The spyware, according to different reports, can turn on phone’s camera and mic, scan through the emails and messages in it, and collect location data of the users.

Facebook in a security advisory published yesterday, explaining the vulnerability, said, “A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of SRTCP packets sent to a target phone number,” adding that the issue affects WhatsApp for Android prior to v2.19.134, WhatsApp Business for Android prior to v2.19.44, WhatsApp for iOS prior to v2.19.51, WhatsApp Business for iOS prior to v2.19.51, WhatsApp for Windows Phone prior to v2.18.348, and WhatsApp for Tizen prior to v2.18.15.

WhatsApp in a statement to The Financial Times, said, “This attack has all the hallmarks of a private company known to work with governments to deliver spyware that reportedly takes over the functions of mobile phone operating systems. We have briefed a number of human rights organizations to share the information we can, and to work with them to notify civil society.”

In another statement to Business Insider, the company added, “WhatsApp encourages people to upgrade to the latest version of our app, as well as keep their mobile operating system up to date, to protect against potential targeted exploits designed to compromise information stored on mobile devices. We are constantly working alongside industry partners to provide the latest security enhancements to help protect our users.”

NSO Group, the company that has built the product and markets it to intelligence agencies for fighting terrorism and crime, in a statement to FT, said, “Under no circumstances would NSO be involved in the operating or identifying of targets of its technology, which is solely operated by intelligence and law enforcement agencies. NSO would not, or could not, use its technology in its own right to target any person or organization.”

It is unclear how many of WhatsApp’s over 1.5 billion users were attacked using the vulnerability but the most recent incident took place on Sunday when the attack was blocked by WhatsApp.