3 ms·

The article claims that "a flaw in WhatsApp-owned servers" was used to "take over users’ phones". This seems to imply that the hackers were able to escape from

The article claims that "a flaw in WhatsApp-owned servers" was used to "take over users’ phones". This seems to imply that the hackers were able to escape from the WhatsApp mobile app to perform other actions on the phones. How would this be possible? Or is this just likely careless journalism, and the exploit was that the server breach allowed the attackers to exfiltrate WhatsApp data only?

d47gktid 7y ago
It was done using pegasus exploit from NSO. A missed video call to the target on WhatsApp was all that necessary to deliver the payload, escape the sandbox & exploit the operating system. What WhatsApp & CitizenLab said to the victims in India about the attack[0]. [0]: https://scroll.in/latest/942218/nagpur-lawyer-notified-by-whatsapp-of-surveillance-says-bhima-koregaon-accused-were-also-targetted https://scroll.in/latest/942218/nagpur-lawyer-notified-by-wh...
JumpCrisscross 7y ago
> How would this be possible? Anecdotally, from a friend at WhatsApp, their engineering has been distracted by integration with Facebook. Holes that would have been patched in an independent WhatsApp may have been left to fester in the-now Facebookdivision.
- chatmasta 7y ago
  I think OP is asking how NSO was able to escape the phone's sandbox model. To do that, they would need an exploit for the phone's OS, in addition to the WhatsApp exploit. So, the obvious question: which operating systems were specifically targeted? Another comment mentions Pegasus... that was an iOS exploit patched in 9.3.5 (3 years ago). Does that line up with the timeline of this article? Given that Android exploits are far more common than iOS, I would expect they had one of those too. But then, where are Apple and Google in this case? It wasn't solely Facebook who was exploited; their app was just the initial vector to escalate to an attack on the OS. NSO probably could have achieved the same with dozens of other apps, but WhatsApp was chosen because of ease of deliverability (messaging) and popularity.
  - lol768 7y ago
    >Given that Android exploits are far more common than iOS, I would expect they had one of those too. The Pixel was the only device that was not pwned in the 2017 Mobile Pwn2Own competition - the iPhone, running iOS 11.1, was exploited 4 times via both WiFi and Safari. I'd be incredinly surprised if NSO were able to compromise an up to date Pixel phone.
    - chatmasta 7y ago
      That’s great for the Pixel. But what percent of Android phones are the Pixel, and not one of the hundreds of other varieties with varying patch schedules? (That’s not entirely snark. I do wonder how high risk individuals are choosing which devices they use for communication.)
      - NPC32419419 7y ago
        What about Android One devices with their monthly patches from Google?
    - saagarjha 7y ago
      That by itself doesn’t mean much; very few people use Pixel devices and there’s significantly less attention put on it.
roywiggins 7y ago
The article says: "The Facebook-owned software giant alleges that NSO Group built and sold a hacking platform that exploited a flaw in WhatsApp-owned servers to help clients hack into the cellphones of at least 1,400 users." The actual complaint reads: "Between in and around April 2019 and May 2019, Defendants used WhatsApp servers, located in the United States and elsewhere, to send malware to approximately 1,400 mobile phones and devices (“Target Devices”). Defendants’ malware was designed to infect the Target Devices for the purpose of conducting surveillance of specific WhatsApp users (“Target Users”). Unable to break WhatsApp’s end-to-end encryption, Defendants developed their malware in order to access messages and other communications after they were decrypted on Target Devices. Defendants’ actions were not authorized by Plaintiffs and were in violation of WhatsApp’s Terms of Service. In May 2019, Plaintiffs detected and stopped Defendants’ unauthorized access and abuse of the WhatsApp Service and computers." https://context-cdn.washingtonpost.com/notes/prod/default/documents/bf5edf35-5672-49fa-aca1-edefadff683f/note/8ef25c0d-fee9-416a-b7f9-e0a4dedc66f2.pdf https://context-cdn.washingtonpost.com/notes/prod/default/do... In other words: WhatsApp does not allege a server breach. It alleges that phones were hacked via carefully crafted messages to trigger an exploit[1] on the phones, but to do that, hackers sent the messages via WhatsApp servers. They mention that, because otherwise they would have less of an argument to sue over. As far as I can tell, they're alleging that NSO Group was part of a scheme to interfere with the WhatsApp relay servers and to break the TOS, stated several different ways under different theories and laws. [1] this one https://nvd.nist.gov/vuln/detail/CVE-2019-3568 https://nvd.nist.gov/vuln/detail/CVE-2019-3568
- hughw 7y ago
  To prove NSO used WhatsApp servers, I suppose WA will have to present inferences from metadata it recorded and saved. So WA will be required to demonstrate how much can yet be learned about its users by passing communications through its servers.

d47gktid 7y ago

It was done using pegasus exploit from NSO. A missed video call to the target on WhatsApp was all that necessary to deliver the payload, escape the sandbox & exploit the operating system. What WhatsApp & CitizenLab said to the victims in India about the attack[0]. [0]: https://scroll.in/latest/942218/nagpur-lawyer-notified-by-whatsapp-of-surveillance-says-bhima-koregaon-accused-were-also-targetted https://scroll.in/latest/942218/nagpur-lawyer-notified-by-wh...

JumpCrisscross 7y ago

> How would this be possible? Anecdotally, from a friend at WhatsApp, their engineering has been distracted by integration with Facebook. Holes that would have been patched in an independent WhatsApp may have been left to fester in the-now Facebookdivision.

chatmasta 7y ago
I think OP is asking how NSO was able to escape the phone's sandbox model. To do that, they would need an exploit for the phone's OS, in addition to the WhatsApp exploit. So, the obvious question: which operating systems were specifically targeted? Another comment mentions Pegasus... that was an iOS exploit patched in 9.3.5 (3 years ago). Does that line up with the timeline of this article? Given that Android exploits are far more common than iOS, I would expect they had one of those too. But then, where are Apple and Google in this case? It wasn't solely Facebook who was exploited; their app was just the initial vector to escalate to an attack on the OS. NSO probably could have achieved the same with dozens of other apps, but WhatsApp was chosen because of ease of deliverability (messaging) and popularity.
- lol768 7y ago
  >Given that Android exploits are far more common than iOS, I would expect they had one of those too. The Pixel was the only device that was not pwned in the 2017 Mobile Pwn2Own competition - the iPhone, running iOS 11.1, was exploited 4 times via both WiFi and Safari. I'd be incredinly surprised if NSO were able to compromise an up to date Pixel phone.
  - chatmasta 7y ago
    That’s great for the Pixel. But what percent of Android phones are the Pixel, and not one of the hundreds of other varieties with varying patch schedules? (That’s not entirely snark. I do wonder how high risk individuals are choosing which devices they use for communication.)
    - NPC32419419 7y ago
      What about Android One devices with their monthly patches from Google?
  - saagarjha 7y ago
    That by itself doesn’t mean much; very few people use Pixel devices and there’s significantly less attention put on it.

roywiggins 7y ago

The article says: "The Facebook-owned software giant alleges that NSO Group built and sold a hacking platform that exploited a flaw in WhatsApp-owned servers to help clients hack into the cellphones of at least 1,400 users." The actual complaint reads: "Between in and around April 2019 and May 2019, Defendants used WhatsApp servers, located in the United States and elsewhere, to send malware to approximately 1,400 mobile phones and devices (“Target Devices”). Defendants’ malware was designed to infect the Target Devices for the purpose of conducting surveillance of specific WhatsApp users (“Target Users”). Unable to break WhatsApp’s end-to-end encryption, Defendants developed their malware in order to access messages and other communications after they were decrypted on Target Devices. Defendants’ actions were not authorized by Plaintiffs and were in violation of WhatsApp’s Terms of Service. In May 2019, Plaintiffs detected and stopped Defendants’ unauthorized access and abuse of the WhatsApp Service and computers." https://context-cdn.washingtonpost.com/notes/prod/default/documents/bf5edf35-5672-49fa-aca1-edefadff683f/note/8ef25c0d-fee9-416a-b7f9-e0a4dedc66f2.pdf https://context-cdn.washingtonpost.com/notes/prod/default/do... In other words: WhatsApp does not allege a server breach. It alleges that phones were hacked via carefully crafted messages to trigger an exploit[1] on the phones, but to do that, hackers sent the messages via WhatsApp servers. They mention that, because otherwise they would have less of an argument to sue over. As far as I can tell, they're alleging that NSO Group was part of a scheme to interfere with the WhatsApp relay servers and to break the TOS, stated several different ways under different theories and laws. [1] this one https://nvd.nist.gov/vuln/detail/CVE-2019-3568 https://nvd.nist.gov/vuln/detail/CVE-2019-3568

hughw 7y ago
To prove NSO used WhatsApp servers, I suppose WA will have to present inferences from metadata it recorded and saved. So WA will be required to demonstrate how much can yet be learned about its users by passing communications through its servers.