Encrypted Messaging Platform WhatsApp Hacked

On Tuesday (May 14), messaging service WhatsApp, which is owned by Facebook (NASDAQ:FB), advised users to update their software after it was revealed that some users have been hacked via phone calls.

According to MarketWatch, hackers have been installing spyware on Android and iPhone devices remotely simply by calling users over the internet.

Facebook shared a security notice on Monday (May 13) that details what versions of WhatsApp are in jeopardy of being compromised.

The attacks came from NSO Group, a cyber intelligence and spy firm based in Israel.

A vulnerability in the WhatsApp system allowed NSO Group to inject malware without targeted users picking up their phones. The inserted malware effectively tracks users’ data and takes it from them. 

The hack was targeted at activists and human rights groups, including a human rights lawyer based in the UK and a researcher at Amnesty International. The exact number of individuals implicated is unknown.

The Guardian reports that if users have received WhatsApp dropped calls or voice calls, they may be among those targeted. Users have been advised to update their WhatsApp application as a safety precaution.

WhatsApp, which is known for its encrypted messaging platform, also provides end-to-end encrypted calling. This is enabled through voice-over-internet-protocol (VoIP). The hackers detected a gap in the platform’s VoIP system.

“In the case of WhatsApp, the protocol for establishing a connection is rather complex, so there is definitely room for exploitable bugs that can be triggered without the other end picking up the call,” Karsten Nohl, chief scientist at German firm Security Research Labs, told Wired.

The bug that caused the WhatsApp vulnerability, known as a buffer-flow vulnerability, targets apps that have experienced a surfeit of data flow that they cannot adequately buffer. Buffering is used in memory storage, where it stores data for a short period of time before the data is used.

“A buffer overflow occurs when a programming error allows more data to be written to a given area of memory than can actually be stored there,” Rik Ferguson, vice president of security research of Trend Micro, told Business Insider.

Problems arise when this happens, causing data to overflow to nearby storage, creating a new opportunity point for hackers to inject malware and intrude in these new areas.

Hacks of this kind have taken place since 1972, Business Insider further reported.

According to CB Insights, in 2018 there were 800 data breaches reported alone. The news outlet notes that industries such as healthcare are becoming increasingly susceptible to attacks, with hackers getting past authentication software and ultimately exploiting healthcare software systems.

Grady Johnston, vice president of channel and alliances at deep learning cybersecurity firm Deep Instinct, told the Investing News Network, “Clients’ current strategy is focused on how they will respond and that they expect to be breached. Deep Instinct is a prevention company and believes that attacks should be stopped at the endpoint.”

Johnston noted that executives are discussing strategies for responding to attacks or data breaches. Deep Instinct applies deep learning capabilities to provide customers with comprehensive multi-layer protection across multiple endpoints.

Based on research from SE Labs, Deep Instinct has shown a 100 percent interception rate for detecting malware and new viruses.

According to Accenture, the average cost of a cybersecurity attack for organizations surveyed was US$13 million in 2018. Costs increased by 11 percent from the previous year, and don’t appear to be diminishing.

Looking ahead into 2019, the use of artificial intelligence (AI) and machine learning in cybersecurity will become a necessity for companies to thwart cyber attacks in real time. Fraud prevention models that implement AI are recommended, says Forbes, in addition to data protection laws and regulations on a national level.

Don’t forget to follow us @INN_Technology for real-time news updates!

Securities Disclosure: I, Dorothy Neufeld, hold no direct investment interest in any company mentioned in this article.

Editorial Disclosure: The Investing News Network does not guarantee the accuracy or thoroughness of the information reported in the interviews it conducts. The opinions expressed in these interviews do not reflect the opinions of the Investing News Network and do not constitute investment advice. All readers are encouraged to perform their own due diligence.