https://lnkd.in/djXHN2z6 More than 1,400 WhatsApp Users Hacked Using Pegasus Spyware
It has come to light that the Israeli company NSO Group, known for developing spyware (including the infamous Pegasus), exploited several 0-day vulnerabilities in WhatsApp. Among these, a previously unknown exploit named Erised was used to deploy Pegasus.
According to documents, until around April 2018, NSO Group utilized a custom WhatsApp client called WhatsApp Installation Server (WIS) and an exploit of their own design named Heaven. This exploit impersonated the official WhatsApp client and was used to install Pegasus on target devices via an external server controlled by NSO.
“WIS could impersonate the official client to access WhatsApp servers and send messages, including call configurations that the official client could not handle,” the documents state. “NSO began testing Heaven on WhatsApp servers around April 2018 and soon after made it available to its clients.”
Once WhatsApp developers discovered the issue, they blocked NSO Group’s access to infected devices and servers through patches released in September and December 2018, rendering the Heaven exploit non-functional.
In February 2019, NSO Group created a new exploit called Eden to bypass WhatsApp’s new security measures. By May 2019, WhatsApp identified that Eden had been used by NSO Group clients to attack approximately 1,400 devices.
Legal documents confirm that NSO Group acknowledges the development and sale of this spyware. The zero-click installation vector, known as Eden, was indeed used in attacks.
Notably, Tamir Gazneli, head of the R&G department at NSO Group, along with other defendants, admitted to developing these exploits by extracting, decompiling, and reverse-engineering WhatsApp’s code.
Upon discovering these attacks, WhatsApp developers patched the vulnerabilities exploited by Eden and deactivated NSO Group’s accounts.
However, even after these attacks were exposed, Eden was blocked in May 2019, and WhatsApp took legal action, NSO Group developed another installation vector called Erised. This exploit utilized WhatsApp’s relay servers to deploy Pegasus.
Court documents reveal that Erised was only blocked in May 2020, during ongoing litigation between WhatsApp and NSO Group. Despite being pressed in court, NSO Group refused to disclose whether the company had developed additional vectors to deliver its malware through WhatsApp.
In court, NSO Group admitted that Pegasus abused WhatsApp’s service to install spyware on “hundreds to tens of thousands” of targeted devices. The company also acknowledged reverse-engineering WhatsApp to develop these attack methods and provided its clients with the technology and WhatsApp accounts required for their operations.
#Israel #spying #nso #whatsapp #Spyware #NSOGroup #CyberSecurity #ZeroDay #Exploits #ReverseEngineering #Hacking #DataLeaks #Surveillance
Security operations manager at Erinys Iraq
5moMattttt are you hiring?