WhatsApp Discovers Major Security Loophole

WhatsApp Discovers Major Security Loophole

Here's what you need to know about WhatsApp's major security flaw.

  • By Sydny Shepard
  • May 16, 2019

The team at WhatsApp, the Facebook-owned messaging platform which has surpassed 1.5 billion users around the world, says a major security loophole was exploited by an Israeli-based group that has a history of working with governments to steal data and spy on citizens.

An article by TechCrunch explained the vulnerability as a, "bug in the audio call feature of the app to allow the caller to enable the installation of spyware on the device being called, whether the call was answered or not."

There's no word yet on how many users were targeted by the attack, but WhatsApp says they believe it is a relatively small group. A fix for the problem was rolled out within 10 days of its discovery. The messaging app is urging all users to update to the latest version of the app to eliminate any further concern.

Craig Young, computer security researcher for Tripwire's VERT (Vulnerability and Exposure Research Team), said that an attack like this should have been somewhat expected.

"A compromised smart phone is a veritable treasure trove for spies looking to infiltrate a target," Young said. "Consider that WhatsApp surpassed 1.5 billion installs over a year ago, it should come as no surprise to anyone that sophisticated adversaries like NSO group are investing resources to develop exploits for it."

Attacks like these have played out in similar messaging services like Apple's iMessage and Google Hangouts, according to Young. He offered up a few tips for organizations hoping to avoid an attack like WhatsApp suffered.

“Organizations concerned about such targeted attacks should be taking extra precautions to limit what data including emails, messages, and account credentials are stored on devices," Young said. "In some cases, it makes sense to have multiple devices for multiple purposes and to restrict the ability to bring phones to sensitive meetings or locations.”

About the Author

Sydny Shepard is the Executive Editor of Campus Security & Life Safety.

Featured

  • Survey: 48 Percent of Worshippers Feel Less Safe Attending In-Person Services

    Almost half (48%) of those who attend religious services say they feel less safe attending in-person due to rising acts of violence at places of worship. In fact, 39% report these safety concerns have led them to change how often they attend in-person services, according to new research from Verkada conducted online by The Harris Poll among 1,123 U.S. adults who attend a religious service or event at least once a month. Read Now

  • AI Used as Part of Sophisticated Espionage Campaign

    A cybersecurity inflection point has been reached in which AI models has become genuinely useful in cybersecurity operation. But to no surprise, they can used for both good works and ill will. Systemic evaluations show cyber capabilities double in six months, and they have been tracking real-world cyberattacks showing how malicious actors were using AI capabilities. These capabilities were predicted and are expected to evolve, but what stood out for researchers was how quickly they have done so, at scale. Read Now

  • Why the Future of Video Security Is Happening Outside the Cloud

    For years, the cloud has captivated the physical security industry. And for good reasons. Remote access, elastic scalability and simplified maintenance reshaped how we think about deploying and managing systems. Read Now

  • UL Solutions Launches Artificial Intelligence Safety Certification Services

    UL Solutions Inc., a global leader in safety science, today announced the launch of artificial intelligence (AI) safety certification services, enabling comprehensive assessments for evaluating the safety of AI-powered products. Read Now

  • ESA Announces Initiative to Introduce the SECURE Act in State Legislatures

    The Electronic Security Association (ESA), the national voice for the electronic security and life safety industry, has announced plans to introduce the SECURE Act in state legislatures across the country beginning in 2025. The proposal, known as Safeguarding Election Candidates Using Reasonable Expenditures, provides a clear framework that allows candidates and elected officials to use campaign funds for professional security services. Read Now

    • Guard Services
Most   Popular

New Products

  • HD2055 Modular Barricade

    Delta Scientific’s electric HD2055 modular shallow foundation barricade is tested to ASTM M50/P1 with negative penetration from the vehicle upon impact. With a shallow foundation of only 24 inches, the HD2055 can be installed without worrying about buried power lines and other below grade obstructions. The modular make-up of the barrier also allows you to cover wider roadways by adding additional modules to the system. The HD2055 boasts an Emergency Fast Operation of 1.5 seconds giving the guard ample time to deploy under a high threat situation.

  • Unified VMS

    AxxonSoft introduces version 2.0 of the Axxon One VMS. The new release features integrations with various physical security systems, making Axxon One a unified VMS. Other enhancements include new AI video analytics and intelligent search functions, hardened cybersecurity, usability and performance improvements, and expanded cloud capabilities

  • A8V MIND

    A8V MIND

    Hexagon’s Geosystems presents a portable version of its Accur8vision detection system. A rugged all-in-one solution, the A8V MIND (Mobile Intrusion Detection) is designed to provide flexible protection of critical outdoor infrastructure and objects. Hexagon’s Accur8vision is a volumetric detection system that employs LiDAR technology to safeguard entire areas. Whenever it detects movement in a specified zone, it automatically differentiates a threat from a nonthreat, and immediately notifies security staff if necessary. Person detection is carried out within a radius of 80 meters from this device. Connected remotely via a portable computer device, it enables remote surveillance and does not depend on security staff patrolling the area.