Per Bloomberg, the suit alleges that from January 2018 to May 2019, NSO created bogus WhatsApp accounts using phone numbers from different countries as well as created a "network of remote servers meant to distribute malware and relay commands to the Target Devices".
WhatsApp is suing the company, NSO Group, for a barrage of high-profile attacks that occurred in May involving a scary (but now patched) vulnerability in the iOS and Android versions of the messaging app. "After the phone rang, the attacker secretly transmitted malicious code in an effort to infect the victim's phone with spyware". No pickup of the call was required.
"As we collected the information that we lay out in our complaint, we learned that the attackers utilised servers and Web-hosting products and services that were being beforehand affiliated with NSO".
The hacking spree targeted journalists, diplomats, human rights activists, political dissidents, senior government officials and others, Facebook said in its lawsuit, filed in U.S. District Court in San Francisco.
"At WhatsApp, we believe people have a fundamental right to privacy and that no one else should have access to your private conversations, not even us", stated Will Cathcart, head of WhatsApp, in an op-ed that The Washington Publish printed on-line Tuesday. All the content will eventually be decrypted when it arrives on your WhatsApp client.
To exploit the vulnerability, NSO Group created fake WhatsApp accounts using phone numbers in countries such as Brazil, Cyprus, Israel, and the Netherlands, among others.
But according to WhatsApp, all the activities constitute computer hacking crimes that involved tampering with the company's servers. The malware was capable of initiating a powerful form of spying that included the ability to intercept communications, steal photos and other forms of data, activate microphones and cameras, track the locations of targets and more, said people familiar with NSO technology.
Facebook and WhatsApp have requested an injunction against the NSO Group, forbidding them to access or attempt to access Facebook or WhatsApp. But the Israeli company is denying the accusations, saying it plans to fight them.
"The safest way to stop NSO's spyware products reaching governments who plan to misuse them is to revoke the company's export license".
"NSO Group claims they responsibly serve governments, but we found more than 100 human rights defenders and journalists targeted in an attack last May".
NSO has recently tried to clean up its image after it was bought by London-based private equity firm Novalpina Capital earlier this year. We take action if we detect any misuse.
Nevertheless, the Israeli company has for years faced accusations of helping oppressive regimes spy on human rights activists, journalists, and politicians. In response to the criticism, NSO Group recently adopted a human rights policy to prevent customers from abusing its technologies, but critics claim the company is doing little to rein in the abuses. NSO Group contends that its software is only used to combat serious crimes.
O said in September that 'human rights protections are embedded throughout all aspects of our work.' Yet it maintains that it has no insight into the targets of its spyware. And he endorsed UN Special Rapporteur for Freedom of Expression David Kaye's call for a moratorium on surveillance technology.