WhatsApp flaw used to install spyware by simply calling the target
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2019-3568 | Buffer Overflow RCE in WhatsApp VoIP Stack via Crafted RTCP Packets A buffer overflow (CWE-122) in the VoIP telephony stack of WhatsApp allowed a remote attacker to achieve remote code execution on a target device by sending a specially crafted series of RTCP packets to the victim's phone number. Because the flaw resided in the call-handling stack of the core app, an attacker who could reach the target's phone number over the network could gain arbitrary code execution on the device. All WhatsApp users at the time of disclosure were potentially exposed, since the vulnerable component shipped in the mainstream Meta Platforms (then Facebook) product rather than an optional add-on. The vulnerability was added to CISA's Known Exploited Vulnerability catalog on 2022-04-19, indicating confirmed real-world exploitation, and its EPSS score of 39.2% (99th percentile) signals a high likelihood of continued exploitation; no public proof-of-concept is known. It was remediated in vendor updates issued in 2019 and is widely associated with targeted espionage use (notably Pegasus spyware deployments). Do: Update WhatsApp on all mobile devices to the latest vendor release, per the CISA KEV required action; inventory your mobile fleet for outdated 2019-era builds and verify current app versions. Prioritize high-value targets (executives, journalists, government personnel) given the vulnerability's confirmed in-the-wild exploitation in espionage campaigns. No public PoC is known, but the flaw is remotely exploitable via network packets to a phone number, so treat patching as urgent. | 9.8 | 30% | KEV |
| mass≈1.5–2 billion users (effectively the entire global WhatsApp user base at the time of disclosure) |
Full article712 words · extracted from helpnetsecurity.com · click to collapse
A security vulnerability in the popular Facebook-owned end-to-end encrypted messaging app WhatsApp allowed attackers to install spyware on smartphones without any user interaction, Financial Times has reported.
Exploitation of the flaw could be triggered by making a WhatsApp call to the target device and manipulating the data packets sent to it when the call is started.
Targets do not have to take the call in order for the exploit to work, and the attackers, once they gain access, can later even delete the call from the app’s call log, erasing all overt evidence of the attack.
About the vulnerability (CVE-2019-3568)
CVE-2019-3568 is a buffer overflow vulnerability in WhatsApp VOIP stack that allows remote code execution via specially crafted series of SRTCP packets sent to a target phone number.
The vulnerability affects:
- WhatsApp for Android prior to v2.19.134
- WhatsApp Business for Android prior to v2.19.44
- WhatsApp for iOS prior to v2.19.51
- WhatsApp Business for iOS prior to v2.19.51
- WhatsApp for Windows Phone prior to v2.18.348, and
- WhatsApp for Tizen prior to v2.18.15.
While the vulnerability has been spotted getting exploited only in extremely targeted attacks and exploitation is not easy for most attackers, the 1.5 billion WhatsApp users around the world are urged to upgrade their WhatsApp as soon as possible.
About the attacks
WhatsApp discovered in early May that the vulnerability was being exploited to deliver the Pegasus mobile spyware developed by Israeli company NSO Group to select targets (it is currently unknown how many).
One of the known targets, though, was a UK-based human rights lawyer who was unsuccessfully attacked on Sunday.
“We had a strong suspicion that the person’s phone was being targeted, so we observed the suspected attack and confirmed that if did not result in an infection,” John Scott-Railton, a senior researchers at the University of Toronto’s Citizen Lab, told FT. “We believe that the measures that WhatsApp put in place in the last several days prevented the attacks from being successful.”
The lawyer in question has been contracted by a group of Mexican journalists and government critics and a Saudi dissident to sue NSO Group in Israel, as they believe the company is partly responsable for any misuse of its software by clients.
NSO Group has denied being behind the attack on the lawyer or any other person or organization and said that “under no circumstances would NSO be involved in the operating or identifying of targets of its technology, which is solely operated by intelligence and law enforcement agencies.”
WhatsApp said that the US Justice Department has been informed of the vulnerability last week.
Comments from the infosec industry
Jake Moore, Security Specialist at ESET, says that while these type of highly targeted attacks are extremely rare, they should not be taken lightly.
“It is clear from this attack that cyber-criminal organisations continue to look for vulnerabilities in applications used by millions of people around the world in the hope they will find something to exploit,” he told Help Net Security.
“Rumors about such security flaws have been circulating for a while already, but few people took them seriously. All corporate users of WhatsApp should urgently launch forensics on their mobile devices to verify whether they were compromised and backdoored,” advised Ilia Kolochenko, Founder, CEO and Chief Architect at ImmuniWeb.
Matthew Aldridge, Senior Solutions Architect at Webroot, says that lines are being blurred between cybersecurity research organisations and nation-state intelligence services.
“This attack may have been in use for some time before being discovered. It highlights the importance of installing updates regularly, but it should also be a reminder to those whose lives depend upon secret communications that they need to choose their toolkit with extreme caution. Relying solely on one secure communications solution on one device isn’t enough,” he pointed out.
“The question as to whether the creators of this exploit and the associated Pegasus spy tool, NSO Group, could have used their technology directly or indirectly for potential gain in legal proceedings is a very serious one. Whether or not they did this, it does highlight the fact that such powerful and potentially dangerous organisations, and their tools, may not be under adequate oversight.”
Several human rights groups, including Amnesty International, are planning to ask an Israeli court to revoke NSO Group’s export license.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2019/05/14/whatsapp-flaw-spyware-cve-2019-3568/