Facebook Sues Over Spyware Planted On WhatsApp

Facebook is gearing up its lawyers to take aggressive legal againts the NSO Group. The social media giant which owns the ubiquitous messaging palaform WhatsApp, is suing the Israeli NSO Group for cyber attacks asserting that the company was responsible for hacking WhatsApp to plant  malevolent  surveillance software. 

WhatsApp claims athe NSO spyware was used to exploit a vulnerability in the app to target approximately 1,400 people between in April and May this year.  

One hundred of those targeted were human rights defenders according to WhatsApp, in countries around the world. The vulnerability, first published about in May, allowed attackers to install spyware by calling the target using WhatsApp.

WhatsApp has launched a lawsuit against the Israeli surveillance firm, alleging that it was behind cyber-attacks on more than 100 human rights activists, lawyers, journalists and academics.

NSO Group, which sells its surveillance technology to governments all over the world, said in a statement on Tuesday 29th October that it disputed the claims in the WhatsApp lawsuit in the “strongest possible terms” and “will vigorously fight them.”

NSO Group added that its technology was used by intelligence and law enforcement agencies in lawful antiterrorism efforts and crime-fighting, and it “has helped to save thousands of lives over recent years.”

WhatsApp claimed in the lawsuit, which it filed in the US state of California this week, that technology sold by NSO was used to target the mobile phones of users in 20 countries over a two-week period. WhatsApp has apparently been working with Citizen Lab, an academic research group which is based in the University of Toronto, to focus on the targets of the cyber-attacks and the technology that was being used. NSO Group, which makes software for surveillance, disputed the allegations.

WhatsApp said in a court filing that the NSO Group “developed their malware in order to access messages and other communications after they were decrypted on target devices”.

WhatsApp first discovered the hack in May. At the time it said that the attack was orchestrated by “an advanced cyber-actor” and it also said...“In May 2019 we stopped a highly sophisticated cyberattack that exploited our video calling system in order to send malware to the mobile devices of a number of WhatsApp users. The nature of the attack did not require targeted users to answer the calls they received. 

“We quickly added new protections to our systems and issued an update to WhatsApp to help keep people safe. We are now taking additional action, based on what we have learned to date.

“We sent a special WhatsApp message to approximately 1,400 users that we have reason to believe were impacted by this attack to directly inform them about what happened…We believe this attack targeted at least 100 members of civil society, which is an unmistakable pattern of abuse,” 

In a separet case, Facebook has recently agreed to pay a £500,000 fine imposed by the UK's data protection watchdog for its role in the Cambridge Analytica scandal. But as part of the agreement, Facebook has not made admission of liability. 

Facebook appealed against the penalty and so the Information Commissioner's Office when on to pursue its own counter-appeal. Facebook has now said it "wished it had done more to investigate Cambridge Analytica" earlier.

Mark Zuckerberg, the CEO of Facebook, has also recently turned down appeals from the US government to sell WhatsApp and Instagram.

WhatsApp:        CityAM:           Economic Times

You Might Also Read: 

Spyware Proliferates To 45 Countries:

 

 

« Georgia Suffers A Nationwide Cyber Attack
Facebook, Free Speech & Fake News »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

Adeptis Group

Adeptis Group

Adeptis are experts in cyber security recruitment, providing bespoke staffing solutions to safeguard your organisation against ever-changing cyber threats.

Texplained

Texplained

Texplained specializes in security audits of microchips to identify vulnerabilities and protect against invasive cyber attacks.

VNCERT

VNCERT

VNCERT is the national Computer Emergency Response Team for Vietnam.

PhishLine

PhishLine

PhishLine helps Information Security Professionals meet and overcome the increasing challenges associated with social engineering and phishing.

AMETIC

AMETIC

AMETIC, is the Association of Electronics, Information and Communications Technologies, Telecommunications and Digital Content Companies in Spain.

Norwegian Information Security laboratory (NISlab)

Norwegian Information Security laboratory (NISlab)

NISlab conducts international competitive research in information and cyber security and operates study programs in this area.

FixMeStick

FixMeStick

FixMeStick is a virus removal device, a USB key that removes malware conventional antivirus software often can’t detect.

LiveAction

LiveAction

LiveAction provides end-to-end visibility of network and application performance from a single pane of glass.

Harvey Nash

Harvey Nash

Harvey Nash is a leading global provider of talent and technology solutions.

Archon Secure

Archon Secure

Archon GoSilent Cube delivers a CSfC-certified, plug-and-play security solution for classified and unclassified communication when using the public Internet.

Dig Security

Dig Security

Dig Security offers the first data detection and response (DDR) solution, providing real-time visibility, control and protection of your data assets across any cloud.

Focus on Security

Focus on Security

Focus on Security are Cyber Security recruitment specialists. We’re dedicated to connecting you with the top Cyber Security talent across the globe. We focus on partnerships and results.

Threat Con

Threat Con

Threat Con is a one of its kind event in Nepal, a series of annual international security conventions similar to the famous Black Hat and DEF CON conferences.

NetHope

NetHope

NetHope is a membership-based organization serving the international nonprofit humanitarian, development, and conservation sector through digital transformation.

Disecto Technologies

Disecto Technologies

At Disecto, we provide SaaS based Data Discovery, Classification and a remediation solution for data privacy compliance.

Clumio

Clumio

Clumio provides autonomous backup and recovery for critical cloud data.