WhatsApp Discovers Major Security Loophole

WhatsApp Discovers Major Security Loophole

Here's what you need to know about WhatsApp's major security flaw.

  • By Sydny Shepard
  • May 16, 2019

The team at WhatsApp, the Facebook-owned messaging platform which has surpassed 1.5 billion users around the world, says a major security loophole was exploited by an Israeli-based group that has a history of working with governments to steal data and spy on citizens.

An article by TechCrunch explained the vulnerability as a, "bug in the audio call feature of the app to allow the caller to enable the installation of spyware on the device being called, whether the call was answered or not."

There's no word yet on how many users were targeted by the attack, but WhatsApp says they believe it is a relatively small group. A fix for the problem was rolled out within 10 days of its discovery. The messaging app is urging all users to update to the latest version of the app to eliminate any further concern.

Craig Young, computer security researcher for Tripwire's VERT (Vulnerability and Exposure Research Team), said that an attack like this should have been somewhat expected.

"A compromised smart phone is a veritable treasure trove for spies looking to infiltrate a target," Young said. "Consider that WhatsApp surpassed 1.5 billion installs over a year ago, it should come as no surprise to anyone that sophisticated adversaries like NSO group are investing resources to develop exploits for it."

Attacks like these have played out in similar messaging services like Apple's iMessage and Google Hangouts, according to Young. He offered up a few tips for organizations hoping to avoid an attack like WhatsApp suffered.

“Organizations concerned about such targeted attacks should be taking extra precautions to limit what data including emails, messages, and account credentials are stored on devices," Young said. "In some cases, it makes sense to have multiple devices for multiple purposes and to restrict the ability to bring phones to sensitive meetings or locations.”

About the Author

Sydny Shepard is the Executive Editor of Campus Security & Life Safety.

Featured

  • The Yellow Brick Road

    The road to and throughout Wednesday's and Thursday's ISC West was crowded but it was amazing. Read Now

    • Industry Events
    • ISC West

  • An Inside Look From Napco at ISC West

    Get a look into the excitement at ISC West 2025 from Napco. Hear from some of their top-tech executives live from the show floor. Read Now

    • Industry Events
    • ISC West

  • Upping the Ante

    I am not a betting man in terms of cards, dice, blackjack or that wheel with the black marble racing around the circumference of a spinning wheel, but I would bet on the success of ISC West this year. Read Now

    • Industry Events
    • ISC West

  • It's Show Time

    I am one of those people that likes to see things get bigger and better. As advertised, ISC West is going to be bigger (more exhibitors) and better (more attendees). It’s show time in Las Vegas. Read Now

    • Industry Events
    • ISC West
Most   Popular

New Products

  • HD2055 Modular Barricade

    Delta Scientific’s electric HD2055 modular shallow foundation barricade is tested to ASTM M50/P1 with negative penetration from the vehicle upon impact. With a shallow foundation of only 24 inches, the HD2055 can be installed without worrying about buried power lines and other below grade obstructions. The modular make-up of the barrier also allows you to cover wider roadways by adding additional modules to the system. The HD2055 boasts an Emergency Fast Operation of 1.5 seconds giving the guard ample time to deploy under a high threat situation.

  • Unified VMS

    AxxonSoft introduces version 2.0 of the Axxon One VMS. The new release features integrations with various physical security systems, making Axxon One a unified VMS. Other enhancements include new AI video analytics and intelligent search functions, hardened cybersecurity, usability and performance improvements, and expanded cloud capabilities

  • Automatic Systems V07

    Automatic Systems V07

    Automatic Systems, an industry-leading manufacturer of pedestrian and vehicle secure entrance control access systems, is pleased to announce the release of its groundbreaking V07 software. The V07 software update is designed specifically to address cybersecurity concerns and will ensure the integrity and confidentiality of Automatic Systems applications. With the new V07 software, updates will be delivered by means of an encrypted file.