Facebook Says Israeli Firm Was Involved in Recent WhatsApp Intrusion

Israeli technology firm NSO Group Wednesday strongly denied allegations by Facebook that it had exploited a security flaw in a WhatsApp's video-calling feature earlier this year to install surveillance software on mobile devices belonging to some 100 human rights activists, journalists, and others.

Facebook made the claim in a federal complaint filed in US District Court for the Northern District of California this week. In the complaint, the social media giant accused NSO Group of being involved in an intrusion in which WhatsApp's servers were used to distribute spyware called Pegasus to some 1,400 targeted devices between April and May.

Facebook described NSO's exploit as giving attackers a way to use WhatsApp's systems to make a video call to a target device and install Pegasus on the device without the victim even having to answer the call.

NSO sells tools for fighting cybercrime, terrorism, and other crimes to governments and law enforcement organizations around the world. Some — like researchers at the Citizen Lab at the University of Toronto — have warned about NSO's tools, particularly Pegasus, being used widely by governments with poor human rights records to conduct surveillance on ordinary citizens and targets of interest. Citizen Lab has identified at least 45 countries where Pegasus is being used to spy on mobile device users.

Facebook, which owns WhatsApp, had earlier hinted at NSO's involvement in the attack, and others had openly speculated about it despite the Israeli firm's strident denials. This week's federal complaint marks the first time Facebook has come out and formally accused NSO of breaking US computer fraud and abuse statutes.

In an opinion piece in The Washington Post on Tuesday, Will Cathcart, vice president of product management at Facebook, said months of investigation had confirmed the company's previous suspicions about NSO Group.

"NSO has previously denied any involvement in the attack, stating that 'under no circumstances would NSO be involved in the operating … of its technology,'" Cathcart said. "But our investigation found otherwise."  

Responding to the claim, NSO, which sells cyber and other crime-fighting technology to governments and law enforcement agencies, said its tools are not designed or licensed for use against human rights activists and journalists. 

"In the strongest possible terms, we dispute today's allegations and will vigorously fight them," the company said via an e-mailed statement to Dark Reading. "The sole purpose of NSO is to provide technology to licensed government intelligence and law enforcement agencies to help them fight terrorism and serious crime."

What the Evidence Shows
According to Cathcart, evidence shows the attackers who broke into WhatsApp's servers used systems and Internet hosting services that were previously associated with NSO. In addition, certain WhatsApp accounts that were used during the attacks point to NSO as well. "While their attack was highly sophisticated, their attempts to cover their tracks were not entirely successful," Cathcart said.

Richard Gold, head of security engineering at Digital Shadows, says Facebook's claim likely rests on multiple, interlocking pieces of evidence. "WhatsApp/Facebook would have access to the registration details, which were used when NSO Group signed up for the operational WhatsApp accounts that were used in the attacks, including name, mobile phone numbers, and IP addresses," he said.

While such data can and often is faked, WhatsApp likely had the resources to identify the individuals or entities that were really behind the accounts. Forensic evidence also would have revealed evidence of Pegasus on the compromised devices. "Since Pegasus is believed to be only available to NSO Group customers, it is reasonable to claim that its presence on compromised devices was due to previous successful exploitation events," Gold says.

NSO, meanwhile, defended its technology as critical to helping law enforcement agencies track down criminals who take advantage of encrypted services such as WhatsApp to carry out malicious activities. "NSO's technologies provide proportionate, lawful solutions to this issue," the company said in its statement.

Any other use of NSO products — particularly those targeting human rights activists and journalists — are contractually prohibited and represent a misuse of the tools, the company said.

Chris Morales, head of security analytics at Vectra, says Facebook's evidence is likely based on origination of traffic and accounts. "The argument will be, who was accountable on the other end of those accounts and who sanctioned the operation of spying?"

Related Content:

This free, all-day online conference offers a look at the latest tools, strategies, and best practices for protecting your organization’s most sensitive data. Click for more information and, to register, here.