<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><a href="https://www.ft.com/content/4da1117e-756c-11e9-be7d-6d846537acab" class="">https://www.ft.com/content/4da1117e-756c-11e9-be7d-6d846537acab</a><div class=""><br class=""></div><div class=""><div class=""><h1 class="topper__headline" data-trackable="header" style="font-family: serif; font-size: 36px; line-height: 40px; font-weight: 400; color: rgb(51, 48, 46); margin: 0px 0px 20px;"><span class="article-classifier__gap">WhatsApp voice calls used to inject Israeli spyware on phones</span></h1></div><div class=""><div style="font-family: sans-serif; font-size: 13.92px; line-height: 20px; margin: 0px; display: inline-block; color: rgb(51, 48, 46);" class=""><a class="n-content-tag n-content-tag--author" href="https://www.ft.com/stream/17c29040-0a47-4863-82cc-f2759454c84b" data-trackable="author" style="color: rgb(51, 48, 46); text-decoration: none; cursor: pointer; border: 0px; display: inline-block; font-size: 13.28px; line-height: 20px; font-weight: 600;">Mehul Srivastava</a> in Tel Aviv</div><span style="color: rgb(51, 48, 46); font-family: sans-serif; font-size: 13px; background-color: rgb(255, 241, 229);" class=""> </span><time class="o-date article-info__timestamp" data-o-component="o-date" datetime="2019-05-13T22:31:14Z" data-o-date-js="" title="May 14, 2019 8:31 am" aria-label="8 hours ago" style="font-family: sans-serif; font-size: 13.92px; line-height: 20px; display: inline-block; text-transform: uppercase; color: rgb(102, 96, 92); margin-bottom: 0px;">8 HOURS AGO</time></div><div class=""><br class=""></div><div class="">A vulnerability in the messaging app WhatsApp has allowed attackers to inject commercial Israeli spyware on to phones, the company and a spyware technology dealer said.</div><div class=""><br class=""></div><div class="">WhatsApp, which is used by 1.5bn people worldwide, discovered in early May that attackers were able to install surveillance software on to both iPhones and Android phones by ringing up targets using the app’s phone call function. </div><div class=""><br class=""></div><div class="">The malicious code, developed by the secretive Israeli company NSO Group, could be transmitted even if users did not answer their phones, and the calls often disappeared from call logs, said the spyware dealer, who was recently briefed on the WhatsApp hack.</div><div class=""><br class=""></div><div class="">WhatsApp is too early into its own investigations of the vulnerability to estimate how many phones were targeted using this method, a person familiar with the issue said.</div><div class=""><br class=""></div><div class="">As late as Sunday, as WhatsApp engineers raced to close the loophole, a UK-based human rights lawyer’s phone was targeted using the same method. </div><div class=""><br class=""></div><div class="">Researchers at the University of Toronto’s Citizen Lab said they believed that the spyware attack on Sunday was linked to the same vulnerability that WhatsApp was trying to patch.</div><div class=""><br class=""></div><div class="">NSO’s flagship product is Pegasus, a program that can turn on a phone’s microphone and camera, trawl through emails and messages and collect location data.</div><div class=""><br class=""></div><div class="">NSO advertises its products to Middle Eastern and Western intelligence agencies, and says Pegasus is intended for governments to fight terrorism and crime. NSO was recently valued at $1bn in a leveraged buyout that involved the UK private equity fund Novalpina Capital</div><div class=""><br class=""></div><div class="">In the past, human rights campaigners in the Middle East have received text messages over WhatsApp that contained links that would download Pegasus to their phones. </div><div class=""><br class=""></div><div class="">WhatsApp said that teams of engineers had worked around the clock in San Francisco and London to close the vulnerability. It began rolling out a fix to its servers on Friday last week, WhatsApp said, and issued a patch for customers on Monday.</div><div class=""><br class=""></div><div class="">“This attack has all the hallmarks of a private company known to work with governments to deliver spyware that reportedly takes over the functions of mobile phone operating systems,” the company said. “We have briefed a number of human rights organisations to share the information we can, and to work with them to notify civil society.”</div><div class=""><br class=""></div><div class="">WhatsApp disclosed the issue to the US Department of Justice last week, according to a person familiar with the matter. A justice department spokesman declined to comment.</div><div class=""><br class=""></div><div class="">NSO said it had carefully vetted customers and investigated any abuse. Asked about the WhatsApp attacks, NSO said it was investigating the issue. </div><div class=""><br class=""></div><div class="">“Under no circumstances would NSO be involved in the operating or identifying of targets of its technology, which is solely operated by intelligence and law enforcement agencies,” the company said. “NSO would not, or could not, use its technology in its own right to target any person or organisation, including this individual [the UK lawyer].”</div><div class=""><br class=""></div><div class="">The UK lawyer, who declined to be identified, has helped a group of Mexican journalists and government critics and a Saudi dissident living in Canada, sue NSO in Israel, alleging that the company shares liability for any abuse of its software by clients. </div><div class=""><br class=""></div><div class="">John Scott-Railton, a senior researcher at the University of Toronto’s Citizen Lab, said the attack had failed. </div><div class=""><br class=""></div><div class="">“We had a strong suspicion that the person’s phone was being targeted, so we observed the suspected attack, and confirmed that it did not result in infection,” said Mr Scott-Railton. “We believe that the measures that WhatsApp put in place in the last several days prevented the attacks from being successful.”</div></div><div class=""><br class=""></div><div class="">More at <a href="https://www.ft.com/content/4da1117e-756c-11e9-be7d-6d846537acab" class="">https://www.ft.com/content/4da1117e-756c-11e9-be7d-6d846537acab</a></div><div class=""><br class=""></div><div class=""><br class=""></div></body></html>