Hackers were able to remotely install surveillance software on phones and other devices using a major vulnerability in messaging app WhatsApp, it has been confirmed.

WhatsApp, which is owned by Facebook, said the attack targeted a "select number" of users, and was orchestrated by "an advanced cyber actor".

A fix was rolled out on Friday.

The attack was developed by Israeli security firm NSO Group, according to a report in the Financial Times.

On Monday WhatsApp urged all of its 1.5bn users to update their apps as an added precaution.

The attack was first discovered earlier this month.

How was the security flaw used?

It involved attackers using WhatsApp's voice calling function to ring a target's device. Even if the call was not picked up, the surveillance software would be installed, and, the FT reported, the call would often disappear from the device's call log.

WhatsApp told the BBC its security team was the first to identify the flaw, and shared that information with human rights groups, selected security vendors and the US Department of Justice earlier this month.

"The attack has all the hallmarks of a private company reportedly that works with governments to deliver spyware that takes over the functions of mobile phone operating systems,” the company said on Monday in a briefing document note for journalists.

The firm also published an advisory to security specialists, in which it described the flaw as: "A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of SRTCP packets sent to a target phone number.”
• On the frontline of India's WhatsApp fake news war

Who is behind the software?

The NSO Group is an Israeli company that has been referred to in the past as a "cyber arms dealer".

Its flagship software, Pegasus, has the ability to collect intimate data from a target device, including capturing data through the microphone and camera, and gathering location data.

In a statement, the group said: "NSO's technology is licensed to authorised government agencies for the sole purpose of fighting crime and terror.

"The company does not operate the system, and after a rigorous licensing and vetting process, intelligence and law enforcement determine how to use the technology to support their public safety missions. We investigate any credible allegations of misuse and if necessary, we take action, including shutting down the system.

"Under no circumstances would NSO be involved in the operating or identifying of targets of its technology, which is solely operated by intelligence and law enforcement agencies. NSO would not or could not use its technology in its own right to target any person or organisation."

Who has been targeted?

WhatsApp said it was too early to know how many users had been affected by the vulnerability, although it added that suspected attacks were highly-targeted.

According to Facebook's latest figures, WhatsApp has around 1.5bn users worldwide.

Amnesty International, which said it had been targeted by tools created by the NSO Group in the past, said this attack was one human rights groups had long feared was possible.

"They're able to infect your phone without you actually taking an action," said Danna Ingleton, deputy programme director for Amnesty Tech. She said there was mounting evidence that the tools were being used by regimes to keep prominent activists and journalists under surveillance.

"There needs to be some accountability for this, it can't just continue to be a wild west, secretive industry."

On Tuesday, a Tel Aviv court will hear a petition led by Amnesty International that calls for Israel's Ministry of Defence to revoke the NSO Group's licence to export its products.

Do you have more information about this or any other technology story? You can reach Dave directly and securely through encrypted messaging app Signal on: +1 (628) 400-7370 </s> WhatsApp uncovered a security flaw which allowed hackers to install and use spyware software on phones, the company has confirmed to Euronews.

It identified and fixed the security flaw but said that some users were targeted.

WhatsApp, an encrypted messaging programme owned by Facebook, began rolling out an upgrade for its estimated 1.5 billion users on Friday.

The flaw allowed attackers to install commercial Israeli surveillance spyware on phones through the messaging app's phone call function, according to a report in the Financial Times (FT).

How did the attack work?

A WhatsApp spokesperson told Euronews that this type of attack "would be highly selective in nature and would be available to only advanced and highly motivated actors".

The "advanced actor" in this case used code developed by Israeli company NSO Group, according to FT.

The spyware manufacturer is known to sell surveillance software to countries such as Saudi Arabia.

By calling a targeted user through the app, hackers could install the Israeli software onto both iPhones and Androids even if the user did not answer the call, the FT report said.

The spyware company's flagship spyware program "Pegasus" can take control of a phone camera and microphone, track movement and record calls.

An NSO spokesperson told Euronews that the company licenses software to "government agencies for the sole purpose of fighting crime and terror," but that "intelligence and law enforcement determine how to use the technology to support their public safety missions."

A UK-based human rights lawyer's phone was targeted as late as Sunday, according to the FT report.

In a statement to Euronews, the Israeli spyware company said "NSO would not or could not use its technology in its own right to target any person or organization, including this individual," presumably referring to the lawyer targeted.

Amnesty International said that the company's "Pegasus" software has been used to target at least 24 human rights defenders, journalists and parliamentarians in Mexico, an Amnesty employee, and Saudi and Emirati activists.

The software reportedly helped Saudi Arabia to spy on journalist Jamal Khashoggi, who was killed in the Saudi consulate in Istanbul in 2018.

The human rights organisation will file a petition on Tuesday at the District Court of Tel Aviv to attempt to stop NSO Group from exporting its products.

Between August 2016 and August 2018, the University of Toronto's "Citizen Lab" tracked the NSO software to 45 countries out of which "at least six countries with significant Pegasus operations have previously been linked to abusive use of spyware to target civil society, including Bahrain, Kazakhstan, Mexico, Morocco, Saudi Arabia, and the United Arab Emirates."

What can you do to protect yourself?

WhatsApp issued a security fix and cybersecurity notice on Monday for users and security professionals.

Users should upgrade the app to get the security fix by checking updates in their phone's application store.

"WhatsApp encourages people to upgrade to the latest version of our app, as well as keep their mobile operating system up to date, to protect against potential targeted exploits designed to compromise information stored on mobile devices," a WhatsApp spokesperson wrote in an email Euronews.

App Versions Affected: WhatsApp for Android prior to v2.19.134, WhatsApp Business for Android prior to v2.19.44, WhatsApp for iOS prior to v2.19.51, WhatsApp Business for iOS prior to v2.19.51, WhatsApp for Windows Phone prior to v2.18.348, and WhatsApp for Tizen prior to v2.18.15. </s> WhatsApp on Monday urged all of its 1.5 billion users to update their apps as an added precaution against hackers who remotely install surveillance software on phones and other devices.

According to reports, the hackers were able to operate using a major vulnerability in the messaging app.

WhatsApp, which is owned by Facebook, said the attack targeted a “select number” of users, and was orchestrated by “an advanced cyber actor”.

A fix was rolled out on Friday.

The attack was developed by Israeli security firm NSO Group, according to a report in the Financial Times.

The attack was first discovered earlier this month, according to the BBC.

It involved attackers using WhatsApp’s voice calling function to ring a target’s device. Even if the call was not picked up, the surveillance software would be installed, and, the FT reported, the call would often disappear from the device’s call log.

WhatsApp told the BBC its security team was the first to identify the flaw, and shared that information with human rights groups, selected security vendors and the US Department of Justice earlier this month.

“The attack has all the hallmarks of a private company reportedly that works with governments to deliver spyware that takes over the functions of mobile phone operating systems,” the company said on Monday in a briefing document note for journalists.

The firm also published an advisory to security specialists, in which it described the flaw as: “A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of SRTCP packets sent to a target phone number.” </s> Hackers were able to remotely install surveillance software on phones and other devices using a major vulnerability in messaging app WhatsApp, it has been confirmed.

WhatsApp, which is owned by Facebook, said the attack targeted a “select number” of users, and was orchestrated by “an advanced cyber actor”.

A fix was rolled out on Friday.

The attack was developed by Israeli security firm NSO Group, according to a report in the Financial Times.

On Monday, WhatsApp urged all of its 1.5 billion users to update their apps as an added precaution.

The attack was first discovered earlier this month.

WhatsApp promotes itself as a “secure” communications app because messages are end-to-end encrypted, meaning they should only be displayed in a legible form on the sender or recipient’s device.

However, the surveillance software would have let an attacker read the messages on the target’s device.

“Journalists, lawyers, activists and human rights defenders” are most likely to have been targeted, said Ahmed Zidan from the non-profit Committee to Protect Journalists.
• Tap the menu at the top left of the screen
• If WhatsApp has recently been updated, it will appear in the list of apps with a button that says Open
• If WhatsApp has not been automatically updated, the button will say Update. Tap Update to install the new version
• The latest version of WhatsApp on Android is 2.19.134
• At the bottom of the screen, tap Updates
• If WhatsApp has recently been updated, it will appear in the list of apps with a button that says Open
• If WhatsApp has not been automatically updated, the button will say Update. Tap Update to install the new version
• The latest version of WhatsApp on iOS is 2.19.51

How was the security flaw used?

It involved attackers using WhatsApp’s voice calling function to ring a target’s device. Even if the call was not picked up, the surveillance software would be installed, and, the FT reported, the call would often disappear from the device’s call log.

WhatsApp told the BBC its security team was the first to identify the flaw, and shared that information with human rights groups, selected security vendors and the US Department of Justice earlier this month.

“The attack has all the hallmarks of a private company reportedly that works with governments to deliver spyware that takes over the functions of mobile phone operating systems,” the company said on Monday in a briefing document note for journalists.

The firm also published an advisory to security specialists, in which it described the flaw as: “A buffer overflow vulnerability in WhatsApp VOIP [voice over internet protocol] stack allowed remote code execution via specially crafted series of SRTCP [secure real-time transport protocol] packets sent to a target phone number.”

Prof Alan Woodward from the University of Surrey said it was a “pretty old-fashioned” method of attack.

“In a buffer overflow, an app is allocated more memory than it actually needs, so it has space left in the memory. If you are able to pass some code through the app, you can run your own code in that area,” he explained.

“In VOIP there is an initial process that dials up and establishes the call, and the flaw was in that bit. Consequently you did not need to answer the call for the attack to work.”

Some users of the app have questioned why the app store notes associated with the latest update are not explicit about the fix.Who is behind the software?

The NSO Group is an Israeli company that has been referred to in the past as a “cyber-arms dealer”.

The business is part-owned by the London-based private equity firm Novalpina Capital, which acquired a stake in February.

NSO’s flagship software, Pegasus, has the ability to collect intimate data from a target device, including capturing data through the microphone and camera, and gathering location data.

On the frontline of India’s WhatsApp fake news war

 WhatsApp sets new rules after mob killings

In a statement, the group said: “NSO’s technology is licensed to authorised government agencies for the sole purpose of fighting crime and terror.

“The company does not operate the system, and after a rigorous licensing and vetting process, intelligence and law enforcement determine how to use the technology to support their public safety missions. We investigate any credible allegations of misuse and if necessary, we take action, including shutting down the system.

“Under no circumstances would NSO be involved in the operating or identifying of targets of its technology, which is solely operated by intelligence and law enforcement agencies. NSO would not or could not use its technology in its own right to target any person or organisation.”

Who has been targeted?

 WhatsApp said it was too early to know how many users had been affected by the vulnerability, although it added that suspected attacks were highly-targeted.

Amnesty International – which said it had been targeted by tools created by the NSO Group in the past – said this attack was one human rights groups had long feared was possible.

“They’re able to infect your phone without you actually taking an action,” said Danna Ingleton, deputy programme director for Amnesty Tech. She said there was mounting evidence that the tools were being used by regimes to keep prominent activists and journalists under surveillance.

“There needs to be some accountability for this, it can’t just continue to be a wild west, secretive industry.”

On Tuesday, a Tel Aviv court will hear a petition led by Amnesty International that calls for Israel’s Ministry of Defence to revoke the NSO Group’s licence to export its products. </s> Cybersecurity experts have warned WhatsApp users to update the messaging app as soon as possible following the discovery of a major vulnerability that could allow attackers to install a malicious code on smartphones.

The Facebook-owned app said it identified and fixed the issue earlier this month but Citizen Lab, a research group at the University of Toronto, suspects that an attacker attempted to exploit it again on Sunday.

WhatsApp believes that a select number of users were targeted by an advanced cyber actor, exploiting its voice calling feature, which it said had all the hallmarks of a private company reportedly that works with governments to deliver spyware that takes over the functions of mobile phone operating systems.

“It demonstrates the importance of keeping your software updated,” said Dr Budi Arief, a cybersecurity expert at the University of Kent.

“I’m not particularly surprised by this development, this happens all the time.

“This recent vulnerability bears a resemblance to the Apple FaceTime vulnerability discovered earlier this year.

“At this stage, it is too early to say whether there is any connection between the WhatsApp vulnerability and the FaceTime vulnerability.

“Software is a very complex system – it’s practically impossible to guarantee it is completely bug-free, there are always potential vulnerabilities that could be exploited.”

WhatsApp said it was deeply concerned about the abuse of such capabilities and is also urging users to update their apps out of an abundance of caution.

The company, which has some 1.5 billion users worldwide, has been in contact with a number of human rights organisations to share information on the incident, as well as US law enforcement to assist in conducting an investigation.

“WhatsApp encourages people to upgrade to the latest version of our app, as well as keep their mobile operating system up to date, to protect against potential targeted exploits designed to compromise information stored on mobile devices,” a spokeswoman said.

“We are constantly working alongside industry partners to provide the latest security enhancements to help protect our users.”

There are concerns that the software was used in attempts to access the phones of human rights campaigners, including a UK-based lawyer.

According to the Financial Times, the spyware was developed by NSO Group, an Israeli cybersecurity and intelligence company.

“Under no circumstances would NSO be involved in the operating or identifying of targets of its technology, which is solely operated by intelligence and law enforcement agencies,” the company told the paper.

“NSO would not, or could not, use its technology in its own right to target any person or organisation, including this individual (the UK lawyer).”

The National Cyber Security Centre (NCSC) has reiterated the importance of keeping devices up to date and published guidance in response to the incident.

“WhatsApp have today announced a vulnerability that could have allowed users’ phones to be compromised,” an NCSC spokesman said.

“The company has reportedly said that a small number of accounts have been affected and has told its users to update their apps using standard updates from the app store as a precaution.

“The NCSC has published guidance for users and always recommends that people protect their device by installing updates as soon as they become available.

“The NCSC also recommends that people switch on automatic updates to install them as quickly as possible.” </s> Cybersecurity experts have warned WhatsApp users to update the messaging app as soon as possible following the discovery of a major vulnerability that could allow attackers to install a malicious code on smartphones.

The Facebook-owned app said it identified and fixed the issue earlier this month but Citizen Lab, a research group at the University of Toronto, suspects that an attacker attempted to exploit it again on Sunday.

WhatsApp believes that a select number of users were targeted by an advanced cyber actor, exploiting its voice calling feature, which it said had all the hallmarks of a private company reportedly that works with governments to deliver spyware that takes over the functions of mobile phone operating systems.

“It demonstrates the importance of keeping your software updated,” said Dr Budi Arief, a cybersecurity expert at the University of Kent.

“I’m not particularly surprised by this development, this happens all the time.

“This recent vulnerability bears a resemblance to the Apple FaceTime vulnerability discovered earlier this year.

“At this stage, it is too early to say whether there is any connection between the WhatsApp vulnerability and the FaceTime vulnerability.

“Software is a very complex system – it’s practically impossible to guarantee it is completely bug-free, there are always potential vulnerabilities that could be exploited.”

WhatsApp said it was deeply concerned about the abuse of such capabilities and is also urging users to update their apps out of an abundance of caution.

The company, which has some 1.5 billion users worldwide, has been in contact with a number of human rights organisations to share information on the incident, as well as US law enforcement to assist in conducting an investigation.

“WhatsApp encourages people to upgrade to the latest version of our app, as well as keep their mobile operating system up to date, to protect against potential targeted exploits designed to compromise information stored on mobile devices,” a spokeswoman said.

“We are constantly working alongside industry partners to provide the latest security enhancements to help protect our users.”

There are concerns that the software was used in attempts to access the phones of human rights campaigners, including a UK-based lawyer.

According to the Financial Times, the spyware was developed by NSO Group, an Israeli cybersecurity and intelligence company.

“Under no circumstances would NSO be involved in the operating or identifying of targets of its technology, which is solely operated by intelligence and law enforcement agencies,” the company told the paper.

“NSO would not, or could not, use its technology in its own right to target any person or organisation, including this individual (the UK lawyer).” </s> Image copyright Getty Images Image caption WhatsApp has 1.5bn users, but it believed the attacks were highly-targeted

Hackers were able to remotely install surveillance software on phones and other devices using a major vulnerability in messaging app WhatsApp, it has been confirmed.

WhatsApp, which is owned by Facebook, said the attack targeted a "select number" of users and was orchestrated by "an advanced cyber-actor".

A fix was rolled out on Friday.

On Monday, WhatsApp urged all of its 1.5 billion users to update their apps as an added precaution.

The surveillance software involved was developed by Israeli firm NSO Group, according to a report in the Financial Times.

Facebook first discovered the flaw in WhatsApp earlier in May.

WhatsApp promotes itself as a "secure" communications app because messages are end-to-end encrypted, meaning they should only be displayed in a legible form on the sender or recipient's device.

However, the surveillance software would have let an attacker read the messages on the target's device.

Some users of the app have questioned why the app store notes associated with the latest update are not explicit about the fix.

Image copyright Twitter

"Journalists, lawyers, activists and human rights defenders" are most likely to have been targeted, said Ahmed Zidan from the non-profit Committee to Protect Journalists.

How do I update WhatsApp?

Android

Open the Google Play store

store Tap the menu at the top left of the screen

Tap My Apps & Games

If WhatsApp has recently been updated, it will appear in the list of apps with a button that says Open

If WhatsApp has not been automatically updated, the button will say Update. Tap Update to install the new version

The latest version of WhatsApp on Android is 2.19.134

iOS

Open the App Store

At the bottom of the screen, tap Updates

If WhatsApp has recently been updated, it will appear in the list of apps with a button that says Open

If WhatsApp has not been automatically updated, the button will say Update. Tap Update to install the new version

The latest version of WhatsApp on iOS is 2.19.51

How was the security flaw used?

It involved attackers using WhatsApp's voice calling function to ring a target's device.

Even if the call was not picked up, the surveillance software could be installed. According to the FT report, the call would often disappear from the device's call log.

WhatsApp told the BBC its security team was the first to identify the flaw. It shared that information with human rights groups, selected security vendors and the US Department of Justice earlier this month.

"The attack has all the hallmarks of a private company reportedly that works with governments to deliver spyware that takes over the functions of mobile phone operating systems,” the company said on Monday in a briefing document note for journalists.

The firm also published an advisory to security specialists, in which it described the flaw as: "A buffer overflow vulnerability in WhatsApp VOIP [voice over internet protocol] stack allowed remote code execution via specially crafted series of SRTCP [secure real-time transport protocol] packets sent to a target phone number.”

Prof Alan Woodward from the University of Surrey said it was a "pretty old-fashioned" method of attack.

"A buffer overflow is where a program runs into memory it should not have access to. It overflows the memory it should have and hence has access to memory in which malicious code can potentially be run," he explained.

"If you are able to pass some code through the app, you can run your own code in that area.

"In VOIP there is an initial process that dials up and establishes the call, and the flaw was in that bit. Consequently you did not need to answer the call for the attack to work."

Who is behind the software?

The NSO Group is an Israeli company that has been referred to in the past as a "cyber-arms dealer".

While some cyber-security companies report the flaws they find so that they can be fixed, others keep problems to themselves so they can be exploited or sold to law enforcement.

The NSO Group is part-owned by the London-based private equity firm Novalpina Capital, which acquired a stake in February.

NSO's flagship software, Pegasus, has the ability to collect intimate data from a target device, including capturing data through the microphone and camera, and gathering location data.

In a statement, the group said: "NSO's technology is licensed to authorised government agencies for the sole purpose of fighting crime and terror.

"The company does not operate the system, and after a rigorous licensing and vetting process, intelligence and law enforcement determine how to use the technology to support their public safety missions. We investigate any credible allegations of misuse and if necessary, we take action, including shutting down the system.

"Under no circumstances would NSO be involved in the operating or identifying of targets of its technology, which is solely operated by intelligence and law enforcement agencies. NSO would not or could not use its technology in its own right to target any person or organisation."

Who has been targeted?

WhatsApp said it was too early to know how many users had been affected by the vulnerability, although it added that suspected attacks were highly-targeted.

According to the New York Times, one of the people targeted was a London-based lawyer involved in a lawsuit against the NSO Group.

Amnesty International, which said it had been targeted by tools created by the NSO Group in the past, said this attack was one human rights groups had long feared was possible.

"They're able to infect your phone without you actually taking an action," said Danna Ingleton, deputy programme director for Amnesty Tech. She said there was mounting evidence that the tools were being used by regimes to keep prominent activists and journalists under surveillance.

"There needs to be some accountability for this, it can't just continue to be a wild west, secretive industry."

On Tuesday, a Tel Aviv court will hear a petition led by Amnesty International that calls for Israel's Ministry of Defence to revoke the NSO Group's licence to export its products.

What are the unanswered questions?

How many people were targeted? WhatsApp says it is too early in its investigation to say how many people were targeted, or how long the flaw was present in the app

WhatsApp says it is too early in its investigation to say how many people were targeted, or how long the flaw was present in the app Does updating WhatsApp remove the spyware? While the update fixes the flaw that let this attack take place, WhatsApp has not said whether the update removes any spyware that has already infected a compromised device

While the update fixes the flaw that let this attack take place, WhatsApp has not said whether the update removes any spyware that has already infected a compromised device What could the spyware do? WhatsApp has not said whether the attack could extend beyond the confines of WhatsApp, reaching further into a device and accessing emails, photos and more

"Using an app as an attack route is limited on iOS as they run apps in very tightly controlled sandboxes," said Prof Woodward. "We're all assuming that the attack was just a corruption of WhatsApp but analysis is still ongoing.

"The nightmare scenario would be if you could get something much more capable onto the device without the user having to do anything," he said.

The BBC has asked WhatsApp for clarification.

_______

Follow Dave Lee on Twitter @DaveLeeBBC

Do you have more information about this or any other technology story? You can reach Dave directly and securely through encrypted messaging app Signal on: +1 (628) 400-7370 </s> A security flaw in WhatsApp has led to the massively popular messaging app becoming the vehicle for a spyware used for a surveillance operation. The malicious software, called Pegasus, can be loaded onto an Android or iOS device via a WhatsApp voice call and then gather information from the device.

Both WhatsApp and NSO Group, the Israeli company responsible for developing the spyware, have confirmed the vulnerability. Pegasus can infect a device via WhatsApp call even if the user doesn't answer, delete its calls from the logs, and hijack the camera and microphone on a device in addition to harvesting communication and location data.
• Eight things we don't like about WhatsApp

Pegasus is sold commercially to Western and Middle Eastern government agencies, ostensibly for counter-terrorism and crime-fighting surveillance efforts. In this case, there are indications that the perpetrators of the latest cyberattacks via WhatsApp may be a Middle Eastern nation trying to silence criticism of its human rights violations. On May 12, Pegasus was used in a failed attempt to compromise the phone of a UK based human rights lawyer who has helped a group of Mexican journalists and government critics and a Saudi dissident living in Canada to sue NSO for liability in the actions of its customers. Middle Eastern human rights activists have been targeted by Pegasus in the past.

WhatsApp alerted the US Justice Department and human rights groups about the threat, asserting that the operation had "all the hallmarks of a private company known to work with governments to deliver spyware that reportedly takes over the functions of mobile phone operating systems". NSO, however, denies any involvement with the attacks after the point of sale. "Under no circumstances would NSO be involved in the operating or identifying of targets of its technology."

The flaw is fixed, so long as you're up-to-date

Although WhatsApp has patched this security flaw at the time of writing, as a precautionary measure the company told users to check that they’re running the latest version of the app on their devices. You can check the latest WhatsApp build by hitting the Play Store button below or getting it from WhatsApp directly.

WhatsApp also advised users to ensure their mobile operating system, whether iOS or Android is up to date to ensure proper protection against potential targeted exploits designed to access information stored on your device. Although NSO claims that it always investigates credible allegations of misuse, and is looking into the WhatsApp call attack, so long as sophisticated spyware can be sold exported to third party actors without much oversight, it won't be easy to prevent similar surveillance campaigns from affecting many in WhatsApps 1.5 billion strong userbase.
• How to transfer WhatsApp chats to a new phone
• How and why you should keep Google Play Services up-to-date

Are you concerned about WhatsApp's security? </s> Facebook's WhatsApp urged users to upgrade to the latest version of its popular messaging app following a report that users could be vulnerable to having malicious spyware installed on phones without their knowledge.

JERUSALEM, May 14 (Reuters) - Facebook's WhatsApp urged users to upgrade to the latest version of its popular messaging app following a report that users could be vulnerable to having malicious spyware installed on phones without their knowledge.

WhatsApp, one of the most popular messaging tools, is used by 1.5 billion people monthly and it has touted its high level of security and privacy, with messages on its platform being encrypted end to end.

"WhatsApp encourages people to upgrade to the latest version of our app, as well as keep their mobile operating system up to date, to protect against potential targeted exploits designed to compromise information stored on mobile devices," a spokesman said.

"We are constantly working alongside industry partners to provide the latest security enhancements to help protect our users," he said. WhatsApp did not elaborate further.

The Financial Times reported that a vulnerability in WhatsApp allowed attackers to inject spyware on phones by ringing up targets using the app's phone call function.

It said the spyware was developed by Israeli cyber surveillance company NSO Group and affects both Android and iPhones. The FT said WhatsApp could not yet give an estimate for how many phone were targeted.

The FT reported that teams of engineers had worked around the clock in San Francisco and London to close the vulnerability and it began rolling out a fix to its servers on Friday last week and issued a patch for customers on Monday.

Asked about the report, NSO said its technology is licensed to authorised government agencies "for the sole purpose of fighting crime and terror," and that it does not operate the system itself while having a rigorous licensing and vetting process.

"We investigate any credible allegations of misuse and if necessary, we take action, including shutting down the system. Under no circumstances would NSO be involved in the operating or identifying of targets of its technology, which is solely operated by intelligence and law enforcement agencies," the company said.

WhatsApp disclosed the issue to the US Department of Justice last week, the FT said.

Facebook co-founder Chris Hughes last week wrote in The New York Times that fellow co-founder Mark Zuckerberg had far too much influence by controlling Facebook, Instagram and WhatsApp, three core communications platforms, and called for the company to be broken up.
WhatsApp confirms a major security bug in the app let hackers remotely install surveillance software on its users' devices. All 1.5 billion users are urged to update WhatsApp as a precaution. The technology used in the cyberattack appears to have originated from NSO Group, a technology company operating out of Israel.