Facebook: NSO Group used U.S.-based servers in operations against WhatsApp users

NSO Group has used American-based servers to spy on WhatsApp users, Facebook and WhatsApp lawyers allege in court documents filed Thursday.

Lawyers for WhatsApp’s parent company alleged in documents filed Thursday that NSO Group, the Israeli software surveillance firm accused of spying on over a thousand WhatsApp users, has used U.S.-based servers to launch its attacks.

In court documents, Facebook-owned WhatsApp claims NSO Group used a server run by Los Angeles-based hosting provider QuadraNet “more than 700 times during the attack to direct NSO’s malware to WhatsApp user devices in April and May 2019.”

Additionally, NSO Group used a remote server hosted by Amazon to target WhatsApp users, WhatsApp software engineer Claudiu Gheorghe said in the filing.

The filing is a blow to NSO Group’s claims that its signature product, Pegasus, isn’t capable of running operations in the United States.

“That invasion of WhatsApp’s servers and users’ devices constitutes unlawful computer hacking at the heart of the [Computer Fraud and Abuse Act]’s unauthorized-access offense,” WhatsApp claims in the filing.

The filing is the latest in a battle that started when WhatsApp sued NSO Group last year over alleged spying on human rights advocates and journalists.

John Scott-Railton, a senior researcher at Citizen Lab at the University of Toronto Monk School of Global Affairs and Public Policy, said the filing will likely degrade NSO Group’s argument that it has no operations in the U.S.

“[It’s] going to be hard for NSO to credibly claim that there is no [United States] nexus to their operations when they were busy paying for server space in American data centers,” Scott-Railton said in a tweet. “This filing shows NSO purchasing [and] operating the servers doing the hacking. This makes the company look much more like hacking-as-a-service than software developers.”

An NSO Group spokesperson reiterated its previous claims in a statement shared with CyberScoop Friday.

“NSO Group does not operate the Pegasus software for its clients, nor can it be used against U.S. mobile phone numbers, or against a device within the geographic bounds of the United States,” the spokesperson said when reached for comment on the latest filings.

WhatsApp’s lawyers also worked to refute NSO Group’s arguments that the case should be dismissed over jurisdictional technicalities, as well as the Israeli company’s planned sovereign immunity defense. The Israeli firm has argued that because its customers are governments that use its products for national security reasons, the firm should be immune from the claims.

WhatsApp lawyers say NSO Group has failed to identify “any specific [government] for whom NSO worked — let alone cite a single contract or any evidence establishing NSO’s purportedly limited operational role,” WhatsApp lawyers said in the filing.

“Defendants pin blame on unidentified [governments],” the filing reads. “That argument fails at every turn: Defendants cannot cloak themselves in their putative clients’ immunity; they are accountable for suit in a California court. NSO is neither a sovereign nor immune from the court’s exercise of jurisdiction.”

You can read the full filing below.

[documentcloud url=”http://www.documentcloud.org/documents/6876945-WhatsApp-Filing-April23-2020-3.html” responsive=true]

Meta accuses NSO Group of defying spyware injunction, files contempt of court complaint

The company said it spotted a spearphishing campaign linked to the Israeli spyware maker targeting WhatsApp users, despite a court order prohibiting it.

WhatsApp releases account feature that looks to combat spyware

CISA alert draws attention to spyware’s targeting of messaging apps

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure

• Election official says Tina Peters would be consultant, won’t have access to election systems