WhatsApp confirms major security breach

The Facebook-owned messaging app, WhatsApp has confirmed a major security breach and warned users some of their data may have been compromised. Showing that even the biggest and best-known of apps aren’t immune to security issues, the hack exploited a vulnerability within the system which meant that spyware could be loaded onto the device using the missed call function.

The cyber attack of the popular messaging platform happened in early May but has only just been confirmed. The app released a statement within the last 24 hours stating that cyber attackers were able to infect the user device with spyware, even if the user impacted didn’t pick up the voice call.

Although the messaging app hasn’t confirmed exactly how many devices have been affected by the intrusion, the platform has 1.5 billion users and says “a select number” have been impacted. The number is thought to be in the dozens rather than the thousands. The company has urged everyone to download the latest version of the software plus the latest operating system update for their devices as all but the most recent version of the app in IOS and Android could be affected.

Reports say that an Israeli company is behind the attack – NSO Group is a spyware company and it’s thought that its technology was used to inject the spyware. Once infected, the device would allow hackers full access, meaning a third-party could read messages, access files, browse contact lists and activate the phone or tablets camera functionality. NSO has refuted the allegations, saying its technology is only used by intelligence agencies and law enforcement and under no circumstances would it be involved in identifying targets or operating its technology.

According to a news report in the Financial Times, the hackers had been using the spyware as recently as Sunday, when a human rights lawyer was targeted. An Amnesty International research is also thought to be amongst those targeted.

The intrusion has been described as “a very scary vulnerability” by experts, as the user would simply need one or two missed voice calls on their device to be infected by the spyware.

WhatsApp said it found the problem during routine work, explaining “our team was putting some additional security enhancements to our voice calls.” It contacted US law enforcement, Citizen Lab and human rights groups upon discovering the intrusion and developed a fix which is being pushed out in the new version of the app.