WhatsApp Discovers Major Security Loophole -- Security Today

WhatsApp Discovers Major Security Loophole

Here's what you need to know about WhatsApp's major security flaw.

By Sydny Shepard
May 16, 2019

The team at WhatsApp, the Facebook-owned messaging platform which has surpassed 1.5 billion users around the world, says a major security loophole was exploited by an Israeli-based group that has a history of working with governments to steal data and spy on citizens.

An article by TechCrunch explained the vulnerability as a, "bug in the audio call feature of the app to allow the caller to enable the installation of spyware on the device being called, whether the call was answered or not."

There's no word yet on how many users were targeted by the attack, but WhatsApp says they believe it is a relatively small group. A fix for the problem was rolled out within 10 days of its discovery. The messaging app is urging all users to update to the latest version of the app to eliminate any further concern.

Craig Young, computer security researcher for Tripwire's VERT (Vulnerability and Exposure Research Team), said that an attack like this should have been somewhat expected.

"A compromised smart phone is a veritable treasure trove for spies looking to infiltrate a target," Young said. "Consider that WhatsApp surpassed 1.5 billion installs over a year ago, it should come as no surprise to anyone that sophisticated adversaries like NSO group are investing resources to develop exploits for it."

Attacks like these have played out in similar messaging services like Apple's iMessage and Google Hangouts, according to Young. He offered up a few tips for organizations hoping to avoid an attack like WhatsApp suffered.

“Organizations concerned about such targeted attacks should be taking extra precautions to limit what data including emails, messages, and account credentials are stored on devices," Young said. "In some cases, it makes sense to have multiple devices for multiple purposes and to restrict the ability to bring phones to sensitive meetings or locations.”

About the Author

Sydny Shepard is the Executive Editor of Campus Security & Life Safety.

Featured

Survey: Nearly Half of Employees Hide Workplace AI Use

Laserfiche, a SaaS provider of intelligent content management and business process automation, recently released new survey findings on AI adoption in the workplace, revealing that nearly half of Americans (49%) who use AI at work keep it to themselves, with 15% deliberately avoiding telling their manager. Read Now
- Artificial Intelligence
- Cybersecurity
46% of Enterprise Passwords Are Vulnerable to Cracking

Picus Security recently released The Blue Report™ 2025, based on more than 160 million real-world attack simulations. Now in its third year, the report provides a data-driven assessment of how well security controls perform against today’s threats — and this year’s findings are the most concerning to date. Read Now
- Cybersecurity
Community-Led Video Security Network Transforms Pennsylvania City Public Safety

A community-supported video security initiative has transformed public safety in Lancaster, Pennsylvania. The citizen-led collaboration demonstrates how open platform video technology can help revitalize struggling urban areas. Read Now
- Government
Browser-Based AI Agents: The Silent Security Threat Unfolding

Some of the most revolutionary advances in artificial intelligence include browser-based AI agents, which are self-sustaining software tools integrated into web browsers that act on behalf of individuals. Read Now
- Cybersecurity
Report: Cybercriminals Abandon Tech Tricks for Personalized Email Deception Tactics

VIPRE Security Group, a cybersecurity, privacy, and data protection company, has released its email threat landscape report for Q2 2025. Through an examination of worldwide real-world data, this report sounds the alarm on the most significant email security trends observed in the second quarter of 2025, enabling organizations to develop effective email security defenses for the remainder of the year. Read Now
- Cybersecurity

Security Today eNews

Sign up today for essential industry news and product information that can help you stay afloat in the fast-paced world of security.

Email Address*Country*

Please type the letters/numbers you see above.

PureTech Systems, Clear Align Partner to Deliver Advanced Autonomous Security, Command-and-Control for U.S. Air Force Tactical Security System

Webinars

Whitepapers

New Products

Camden CV-7600 High Security Card Readers

Camden Door Controls has relaunched its CV-7600 card readers in response to growing market demand for a more secure alternative to standard proximity credentials that can be easily cloned. CV-7600 readers support MIFARE DESFire EV1 & EV2 encryption technology credentials, making them virtually clone-proof and highly secure.
A8V MIND

Hexagon’s Geosystems presents a portable version of its Accur8vision detection system. A rugged all-in-one solution, the A8V MIND (Mobile Intrusion Detection) is designed to provide flexible protection of critical outdoor infrastructure and objects. Hexagon’s Accur8vision is a volumetric detection system that employs LiDAR technology to safeguard entire areas. Whenever it detects movement in a specified zone, it automatically differentiates a threat from a nonthreat, and immediately notifies security staff if necessary. Person detection is carried out within a radius of 80 meters from this device. Connected remotely via a portable computer device, it enables remote surveillance and does not depend on security staff patrolling the area.
Mobile Safe Shield

SafeWood Designs, Inc., a manufacturer of patented bullet resistant products, is excited to announce the launch of the Mobile Safe Shield. The Mobile Safe Shield is a moveable bullet resistant shield that provides protection in the event of an assailant and supplies cover in the event of an active shooter. With a heavy-duty steel frame, quality castor wheels, and bullet resistant core, the Mobile Safe Shield is a perfect addition to any guard station, security desks, courthouses, police stations, schools, office spaces and more. The Mobile Safe Shield is incredibly customizable. Bullet resistant materials are available in UL 752 Levels 1 through 8 and include glass, white board, tack board, veneer, and plastic laminate. Flexibility in bullet resistant materials allows for the Mobile Safe Shield to blend more with current interior décor for a seamless design aesthetic. Optional custom paint colors are also available for the steel frame.