WhatsApp flaw let hackers install spyware on cellphones when people made or got calls

/ CBS/AP

The tool meant to hack any smartphone

Spyware created by a sophisticated group of hackers-for-hire took advantage of a flaw in the WhatsApp communications program used by more than 1.5 billion people worldwide to remotely hijack dozens of phones, the company said late Monday. The Financial Times identified the firm as Israel's NSO Group, and WhatsApp all but confirmed the identification.

WhatsApp described the hackers to CBS News as having "all the hallmarks of a private company that works with a number of governments around the world," adding to The Associated Press that they do so "to deliver spyware." A spokesman for the Facebook subsidiary later told the AP: "We're certainly not refuting any of the coverage you've seen."

WhatsApp also told CBS News, "We have made information available to U.S. law enforcement for further review. We may make additional information available as appropriate."

Trending News

"WhatsApp encourages people to upgrade to the latest version of our app, as well as keep their mobile operating system up to date, to protect against potential targeted exploits designed to compromise information stored on mobile devices," the spokesman said to CBS News. "We are constantly working alongside industry partners to provide the latest security enhancements to help protect our users."

The malware was able to penetrate phones through missed calls alone via the app's voice calling function, the spokesman told AP. An unknown number of people – an amount in the dozens at least would not be inaccurate – were infected with the malware, which the company discovered in early May, said the spokesman, who was not authorized to be quoted by name.

In the past, NSO's spyware has repeatedly been found deployed to hack journalists, lawyers, human rights activists and dissidents.

John Scott-Railton, a researcher with the internet watchdog Citizen Lab, called the latest hack "a very scary vulnerability."

"There's nothing a user could have done here, short of not having the app," he said.

The spokesman said the flaw was discovered while "our team was putting some additional security enhancements to our voice calls" and that engineers found that people targeted for infection "might get one or two calls from a number that is not familiar to them. In the process of calling, this code gets shipped."

WhatsApp immediately contacted Citizen Lab and human rights groups, quickly fixed the issue and pushed out a patch. "We are deeply concerned about the abuse of such capabilities," WhatsApp said in a statement.

NSO said in a statement that its technology is used by law enforcement and intelligence agencies to fight "crime and terror."

"We investigate any credible allegations of misuse and if necessary, we take action, including shutting down the system," the statement said. A spokesman for Stephen Peel, whose private equity firm Novalpina recently announced the purchase of part of NSO, did not return an email seeking comment.

The revelation adds to the questions over the reach of the Israeli company's powerful spyware, which takes advantage of digital flaws to hijack smartphones, control their cameras and effectively turn them into pocket-sized surveillance devices.

NSO spyware was implicated in the gruesome killing of Saudi journalist Jamal Khashoggi, who was dismembered in the Saudi consulate in Istanbul last year and whose body has never been found.

Several alleged targets of the spyware, including a close friend of Khashoggi and several Mexican civil society figures, are currently suing NSO in an Israeli court over the hacking.

Monday, Amnesty International – which said last year that one its staffers was also targeted with the spyware – said it would join in a legal bid to force Israel's Ministry of Defense to suspend NSO's export license.

That makes the discovery of the vulnerability particularly disturbing because one of the targets was a U.K.-based human rights lawyer, the attorney told the AP.

The lawyer, who spoke on condition of anonymity for professional reasons, said he received several suspicious missed calls over the past few months, the most recent one on Sunday, only hours before WhatsApp issued the update to users fixing the flaw.

In its statement, NSO said it "would not or could not" use its own technology to target "any person or organization, including this individual."

First published on May 14, 2019 / 4:30 AM

© 2019 CBS Interactive Inc. All Rights Reserved. This material may not be published, broadcast, rewritten, or redistributed. The Associated Press contributed to this report.

Ghostwriter: Trump worries over biz losses "never lasted long"

Charles Leershon, who penned book with Trump that came out in 1990s, says he always had backers coming to his rescue when ventures did poorly

1H ago

U.S. attorney to review Russia probe

The attorney general has asked the U.S. attorney in Connecticut, John Durham, to review the origins of the Russia investigation

4H ago

2 sightseeing planes in deadly midair collision over Alaska

There were 16 people on the planes in all, mostly cruise ship tourists, and several people lost their lives; NTSB investigators are heading to the scene

1H ago

Trump backs early moon landing with funding request

Trump administration asks Congress to kick-start NASA moon mission with $1.6 billion in additional 2020 funding

7H ago

More than 5,000 migrants returned under "Remain in Mexico" policy

Mexican government officials say the U.S. government's practice is fueling an unsustainable situation for their government

7H ago

Ghostwriter: Trump worries over biz losses "never lasted long"

Charles Leershon, who penned book with Trump that came out in 1990s, says he always had backers coming to his rescue when ventures did poorly

1H ago

U.S. attorney to review Russia probe

The attorney general has asked the U.S. attorney in Connecticut, John Durham, to review the origins of the Russia investigation

4H ago

Trump backs early moon landing with funding request

Trump administration asks Congress to kick-start NASA moon mission with $1.6 billion in additional 2020 funding

7H ago

More than 5,000 migrants returned under "Remain in Mexico" policy

Mexican government officials say the U.S. government's practice is fueling an unsustainable situation for their government

7H ago

11-year-old rape victim couldn't have abortion under new Ohio law

Under Ohio's new "heartbeat bill," abortions after about six weeks are prohibited, even if the pregnancy is a result of rape or incest

12H ago

More than 5,000 migrants returned under "Remain in Mexico" policy

Mexican government officials say the U.S. government's practice is fueling an unsustainable situation for their government

7H ago

Beyond tariffs, China has other ways to retaliate

In a deepening trade war, Beijing could make doing business within its borders harder for U.S. companies

8H ago

Will China pull the trigger and dump U.S. Treasuries?

Chinese government's $1 trillion in U.S. debt gives it some economic leverage, but a fire-sale would scorch both ways

8H ago

Venezuelan opposition asks for meeting with U.S. military

The Trump administration has not ruled out military action in the crisis-stricken South American country

14H ago

American breaks record with deepest-ever sub dive, finds plastic

The diver's team found four new species and something else no other expedition has seen — pollution

9H ago

HBO drops official trailer for "Game of Thrones" documentary

The video shows Emilia Clarke walking off the set after her final scene and other major moments of the show's final season

4H ago

New on Netflix, Hulu and Amazon

Shows and movies you'll want to stream in May

Apr 26 36 photos

"Game of Thrones" baby names are more popular than ever

Who will win the Name of Thrones?

8H ago

Met Gala 2019: Red carpet looks

See what all your favorite celebrities wore to fashion's biggest night

May 6 80 photos

Hollywood icon Doris Day dies

Academy Award-winning singer Doris Day has died. The actress, known for films in "The Man Who Knew Too Much" and "Pillow Talk," was 97. Lee Cowan has a look back at her life and legacy.

8H ago 01:56

WhatsApp flaw let hackers install spyware on cellphones

Signs point to Israeli company NSO, which works with governments, often to spy on human rights activists; spyware kicked in when people made or got calls

20M ago

San Francisco considers facial recognition ban

Civil liberty watchdogs argue the technology can be inaccurate

10H ago

Amazon warehouses reportedly trash millions of unsold products

Retailer under fire after exposes of massive waste in the U.K. and France, where new toys and TVs were sent to dumps

11H ago

Facebook now paying $18 an hour to block suicide videos

Some workers responsible for cleaning up disturbing material have reported low pay and difficult working conditions

13H ago

Amazon to employees: We'll pay you to quit and haul packages

Hurtling towards one-day shipping deadlines, Amazon is offering its employees $10,000 to start delivery businesses

16H ago

"The planet's on f***ing fire!" Bill Nye's climate rant goes viral

He's not the same kid-friendly "Science Guy" millennials grew up with

10H ago

American breaks record with deepest-ever sub dive, finds plastic

The diver's team found four new species and something else no other expedition has seen — pollution

9H ago

An extinct bird species has evolved back into existence, study says

It's an example of iterative evolution — when the same ancestral lineage leads to repeated evolution of a species at different points in time

May 10

Virgin Galactic announces new steps toward offering thrill rides to space

New Mexico officials have eagerly anticipated the arrival of space tourism by Virgin Galactic for more than a decade

May 10

Jeff Bezos says lunar lander can carry crews to the moon by 2024

Lunar lander unveiled as NASA puts finishing touches on plans to return astronauts to the moon by 2024

May 10

11-year-old rape victim couldn't have abortion under new Ohio law

Under Ohio's new "heartbeat bill," abortions after about six weeks are prohibited, even if the pregnancy is a result of rape or incest

12H ago

Alabama could pass a near-total abortion ban tomorrow

Alabama could pass a near-total ban on abortion as soon as tomorrow

13H ago

Connecticut AG calls alleged drug price-fixing an "attack"

43 states and Puerto Rico filed a complaint Friday alleging 20 companies coordinated to inflate prices and reduce competition on more than 100 generic prescription drugs

14H ago

In deep-red West Virginia, Warren touts plan to fight opioid crisis

A dozen locals in full Trump garb stood watch in a nearby parking lot while about 150 people listened to the Massachusetts Democrat discuss her proposal

May 12

Teaching anti-vax parents to trust science and the MMR vaccine

With hundreds of measles cases in the U.S., and approximately 110K global deaths from measles in 2017 (mostly children under five), public health experts are employing scientific facts as an antidote to vaccine misinformation

May 12

Jury awards couple $2 billion in weed killer cancer trial

This is the third lawsuit related to Roundup that Monsanto has lost in the state of California

9H ago

Who accepts cryptocurrency? Whole Foods and Bed Bath & Beyond among retailers

Global payments network Flexa announces 15 retailers will take bitcoin, bitcoin cash, ether and Gemini dollars

10H ago

Amazon warehouses reportedly trash millions of unsold products

Retailer under fire after exposes of massive waste in the U.K. and France, where new toys and TVs were sent to dumps

11H ago

Beyond tariffs, China has other ways to retaliate

In a deepening trade war, Beijing could make doing business within its borders harder for U.S. companies

8H ago

Will China pull the trigger and dump U.S. Treasuries?

Chinese government's $1 trillion in U.S. debt gives it some economic leverage, but a fire-sale would scorch both ways

8H ago

Crime

Facial recognition ban considered

More law enforcement agencies are relying on facial recognition technology to help fight crime. But there's growing public fear over the technology — and San Francisco is considering a ban. Jonathan Vigliotti explains.

8H ago 02:13

Pilot arrested before takeoff

An American Airlines pilot was arrested at the Louisville Airport for a triple murder he allegedly committed four years ago. He was still in his uniform when police took his booking photo. Kris Van Cleave reports.

9H ago 01:35

Felicity Huffman pleads guilty

Actress Felicity Huffman pleaded guilty to her role in the college admissions scandal. Prosecutors said she paid thousands to have a proctor correct answers on her daughter's college entrance exam. Carter Evans reports.

9H ago 02:11

"One terrible punch": Victim in NYC anti-Semitic attack speaks out

Two hate crimes this month in Brooklyn come as anti-Semitic crimes spike in New York and across the country

10H ago

Judge blocks release of Coast Guard officer accused of drafting hit list

A magistrate had ordered Christopher Hasson to be released from custody and supervised by relatives in Virginia

10H ago

Trump backs early moon landing with funding request

Trump administration asks Congress to kick-start NASA moon mission with $1.6 billion in additional 2020 funding

7H ago

Shrinking moon may be causing "moonquakes"

NASA says the moon is shrinking and it may be creating so-called "moonquakes." Scientists say the moon's interior is cooling and causing it to shrivel up like a raisin. The shrinking has caused ridges on the moon's surface called "thrust faults" — where one section of crust is pushed up over a neighboring part. Scientists now believe those faults are to blame for the tremors.

3H ago 00:44

Virgin Galactic announces new steps toward offering thrill rides to space

New Mexico officials have eagerly anticipated the arrival of space tourism by Virgin Galactic for more than a decade

May 10

SpaceX cargo ship reaches space station

SpaceX delivers 5,500 pounds of equipment and supplies to the space station

May 6

SpaceX launches unpiloted cargo ship to space station

The Dragon is loaded with nearly 5,500 pounds of equipment

May 4

Britain's royal great-grandchildren

Prince Harry's new baby Archie is the eighth great-grandchild for Queen Elizabeth and Prince Philip

May 8 9 photos

Met Gala 2019: Red carpet looks

See what all your favorite celebrities wore to fashion's biggest night

May 6 80 photos

Dale Pike murder: Evidence photos in the case against Enrico Forti

In 1998, Dale Pike came to Miami to discuss a business deal with Enrico Forti — the next day he was dead, and Forti was the prime suspect

May 3 17 photos

Worst movie sequels since 2000, ranked

These are the lowest-rated sequels this century, according to Metacritic's rankings

Apr 30 51 photos

Private secrets shared via postcard

Since 2004, hundreds of thousands of anonymous contributors with something to get off their chest have sent postcards to the website PostSecret.com

Apr 28 32 photos

Popular

Federal prosecutor to look into Russia probe

Attorney General William Barr has asked the U.S. Attorney in Connecticut, John Durham, to review the origins of the Russia investigation, making it the third third investigation of its kind. The Department of Justice's Office of Inspector General is examining the DOJ's handling of the investigation and the U.S. Attorney in Utah was previously asked to review aspects of the investigation.

4H ago 00:23

2 sightseeing planes collide in Alaska

The National Transportation Safety Board will be heading to Alaska to investigate a fatal midair collision between two sightseeing airplanes near a southeast Alaska town Monday. At least three people have been killed and a search continues for several others.

5H ago 00:36

How Trump's trade war affects you

President Trump hosted Hungarian Prime Minister Viktor Orbán at the White House on Monday, more than 20 years since his last visit. The far-right leader has sparked controversy by reshaping the government, news media and other Hungarian institutions. Yascha Mounk, an associate professor at Johns Hopkins University and senior adviser at Protect Democracy, joins CBSN to discuss what concerns this meeting has raised in Washington.

6H ago 05:37

Shrinking moon may be causing "moonquakes"

NASA says the moon is shrinking and it may be creating so-called "moonquakes." Scientists say the moon's interior is cooling and causing it to shrivel up like a raisin. The shrinking has caused ridges on the moon's surface called "thrust faults" — where one section of crust is pushed up over a neighboring part. Scientists now believe those faults are to blame for the tremors.

3H ago 00:44

Jimmy Carter recovering after breaking hip

Jimmy Carter is recovering from surgery after the 94-year-old fell and broke his hip Monday morning. The former president was at his home in Plains, Georgia and is "recovering comfortably" at a hospital in nearby Americus, Georgia, with his wife of 72 years, former first lady Rosalynn Carter.

8H ago 00:34