WhatsApp sues the notorious spyware vendor NSO Group and says the company was actively involved in hacking users of the encrypted chat service.
A major software vulnerability was revealed in WhatsApp in May. The error allows hackers to load spyware onto a phone via a video call, even if the person has never answered the call. Citizen Lab, the organization that discovered the vulnerability, said at the time that the attack was used to reach journalists and human rights activists. The spyware used in the attacks, called Pegasus, was developed by the Israel-based NSO Group, whose software has been used by repressive governments around the world.
When the WhatsApp error came to light, NSO Group said it was not involved in the direct use of its software, and only provided it to governments. But in a Washington Post opinion article WhatsApp chief Will Cathcart, published today, says the company has evidence of NSO Group's direct involvement in the attack. "We are now trying to hold NSO accountable under US and federal laws, including the US Computer Fraud and Abuse Act," writes Cathcart.
According to Cathcart, WhatsApp, owned by Facebook, linked servers and services used in the attack with NSO Group, and also discovered evidence that linked WhatsApp accounts that were used in the attack on the spyware vendor. "Although their attack was very advanced," Cathcart writes, "their attempts to make their mark were not entirely successful." According to WhatsApp, around 1,400 devices were infected with the malicious code.
In a related announcement Citizen Lab said it publicly attributed the attack to NSO Group. NSO Group did not immediately respond to a request for comment on the lawsuit.
WhatsApp requests a court to prevent the NSO Group from taking similar actions in the future and awarding compensation. "WhatsApp will continue to do everything we can within our code and within the courts to help protect the privacy and security of our users everywhere," Cathcart writes.