- WhatsApp patches vulnerability used to implement graphite
- Graphite is a commercial spyware built by Israeli Devs Paragon
- About 90 people were targeted, whatsapp said
WhatsApp says it has established a zero-day vulnerability, which was apparently used by nation states to spy on journalists, dissidents, political opponents and others.
After being tipped by security researchers from Citizen Lab, WhatsApp addressed a mistake that allowed threat actors to implement graphite, a sophisticated spyware tool developed by the Israeli company Paragon Solutions.
Graphite was inserted into a “zero -click” attack, which means no interaction from the victim was needed.
Protecting your Android phone
“WhatsApp has disturbed a spyware campaign by Paragon that targeted a number of users, including journalists and members of civil society. We have reached directly to people we think were affected,” a WhatsApp spokesman told told told Bleeping computer.
“This is the latest example of why spyware -companies should be held responsible for their illegal actions. WhatsApp will continue to protect people’s ability to communicate privately.”
A cve was not awarded the vulnerability.
WhatsApp also said it informed that some 90 people, which are in more than two dozen countries, including Italian journalists and activists.
In theory, the attack was very simple. After getting their target’s phone numbers, the threat actors would add them to a WhatsApp group before sending a weapon PDF. As the device automatically processes PDF files, the endpoint is compromised without any action from the user. The next step is to escape the Android sandbox and install spyware that gives attackers access to device messaging applications.
Citizen Lab analyzed Graphit’s infrastructure and found “potential relations with several government customers”, including Australia, Canada, Cyprus, Denmark, Israel and Singapore.
Governments in Europe and the United States have been quite vocal in their opposition to commercial spyware. In February 2022, the European Data Protection Supervisor (EDPS) recommended to ban the use of Pegasus Spyware within the EU, with reference to concern about fundamental rights and freedoms. Pegasus’ developer team, NGO Group, was blacklisted in the United States on November 3, 2021.
