WhatsApp Discovers Major Security Loophole

WhatsApp Discovers Major Security Loophole

Here's what you need to know about WhatsApp's major security flaw.

  • By Sydny Shepard
  • May 16, 2019

The team at WhatsApp, the Facebook-owned messaging platform which has surpassed 1.5 billion users around the world, says a major security loophole was exploited by an Israeli-based group that has a history of working with governments to steal data and spy on citizens.

An article by TechCrunch explained the vulnerability as a, "bug in the audio call feature of the app to allow the caller to enable the installation of spyware on the device being called, whether the call was answered or not."

There's no word yet on how many users were targeted by the attack, but WhatsApp says they believe it is a relatively small group. A fix for the problem was rolled out within 10 days of its discovery. The messaging app is urging all users to update to the latest version of the app to eliminate any further concern.

Craig Young, computer security researcher for Tripwire's VERT (Vulnerability and Exposure Research Team), said that an attack like this should have been somewhat expected.

"A compromised smart phone is a veritable treasure trove for spies looking to infiltrate a target," Young said. "Consider that WhatsApp surpassed 1.5 billion installs over a year ago, it should come as no surprise to anyone that sophisticated adversaries like NSO group are investing resources to develop exploits for it."

Attacks like these have played out in similar messaging services like Apple's iMessage and Google Hangouts, according to Young. He offered up a few tips for organizations hoping to avoid an attack like WhatsApp suffered.

“Organizations concerned about such targeted attacks should be taking extra precautions to limit what data including emails, messages, and account credentials are stored on devices," Young said. "In some cases, it makes sense to have multiple devices for multiple purposes and to restrict the ability to bring phones to sensitive meetings or locations.”

About the Author

Sydny Shepard is the Executive Editor of Campus Security & Life Safety.

Featured

  • 2025 Security LeadHER Conference Program Announced

    ASIS International and the Security Industry Association (SIA) – the leading membership associations for the security industry – have announced details for the 2025 Security LeadHER conference, a special event dedicated to advancing, connecting and empowering women in the security profession. The third annual Security LeadHER conference will be held Monday, June 9 – Tuesday, June 10, 2025, at the Detroit Marriott Renaissance Center in Detroit, Michigan. This carefully crafted program represents a comprehensive professional development opportunity for women in security this year. To view the full lineup at this year’s event, please visit securityleadher.org. Read Now

    • Industry Events

  • Report: 82 Percent of Phishing Emails Used AI

    KnowBe4, the world-renowned cybersecurity platform that comprehensively addresses human risk management, today launched its Phishing Threat Trend Report, detailing key trends, new data, and threat intelligence insights surrounding phishing threats targeting organizations at the start of 2025. Read Now

  • NRF Supports Federal Bill to Thwart Retail Crime

    The National Retail Federation recently announced its support for the Combating Organized Retail Crime Act of 2025. The act was introduced by Chairman Chuck Grassley, R-Iowa, Senator Catherine Cortez Masto, D-Nev., and Representative Dave Joyce, R-Ohio. Read Now

  • ISC West 2025 Brings Almost 29,000 Industry Professionals to Las Vegas

    ISC West 2025, organized by RX and in collaboration with the Security Industry Association, concluded at the Venetian Expo in Las Vegas last week. The nation’s leading comprehensive and converged security event attracted nearly 29,000 industry professionals and left a lasting impression on the global security community. Over five action-packed days, ISC West welcomed more than 19,000 attendees and featured 750 exhibiting brands. Read Now

    • Industry Events
    • ISC West

  • Tradeshow Work Can Be Fun

    While at ISC West last week, I ran into numerous friends and associates all of which was a pleasant experience. The first question always seemed to be, “How many does this make for you?” Read Now

    • Industry Events
    • ISC West
Most   Popular

New Products

  • QCS7230 System-on-Chip (SoC)

    QCS7230 System-on-Chip (SoC)

    The latest Qualcomm® Vision Intelligence Platform offers next-generation smart camera IoT solutions to improve safety and security across enterprises, cities and spaces. The Vision Intelligence Platform was expanded in March 2022 with the introduction of the QCS7230 System-on-Chip (SoC), which delivers superior artificial intelligence (AI) inferencing at the edge.

  • Compact IP Video Intercom

    Viking’s X-205 Series of intercoms provide HD IP video and two-way voice communication - all wrapped up in an attractive compact chassis.

  • Mobile Safe Shield

    Mobile Safe Shield

    SafeWood Designs, Inc., a manufacturer of patented bullet resistant products, is excited to announce the launch of the Mobile Safe Shield. The Mobile Safe Shield is a moveable bullet resistant shield that provides protection in the event of an assailant and supplies cover in the event of an active shooter. With a heavy-duty steel frame, quality castor wheels, and bullet resistant core, the Mobile Safe Shield is a perfect addition to any guard station, security desks, courthouses, police stations, schools, office spaces and more. The Mobile Safe Shield is incredibly customizable. Bullet resistant materials are available in UL 752 Levels 1 through 8 and include glass, white board, tack board, veneer, and plastic laminate. Flexibility in bullet resistant materials allows for the Mobile Safe Shield to blend more with current interior décor for a seamless design aesthetic. Optional custom paint colors are also available for the steel frame.