How Israeli Spyware Pegasus Snooped On Indian WhatsApp Users

India’s woes with data privacy issues seem to be never-ending and once again WhatsApp is caught in the middle of it. It has been confirmed that Israeli spyware Pegasus has snooped over Whatsapp data of academicians, lawyers, journalists and scheduled caste activists in India. 

Reportedly, Pegasus, a surveillance firm created by Israel’s private NSO Group, was involved in scrutiny in India during the run-up to the 2019 General Elections. 

As of now, WhatsApp hasn’t revealed the names or numbers of the users who were targeted by Pegasus. However, the company claimed it has contacted the affected users and has also alerted them that their smartphones were under surveillance.

The social media company accused NSO of helping Israeli government spies break into the phones of around 1,400 users across four continents. In response, WhatsApp took NSO group to court in the US on Tuesday this week.

The lawsuit filed by WhatsApp highlighted Pegasus was used to hijack smartphones running on major operating systems such as iOS, Android and BlackBerry. 

The Pegasus Spyware affected versions of WhatsApp are as follows:

• WhatsApp for Android prior to v2.19.134
• WhatsApp Business for Android prior to v2.19.44
• WhatsApp for iOS prior to v2.19.51
• WhatsApp Business for iOS prior to v2.19.51
• WhatsApp for Windows Phone prior to v2.18.348
• WhatsApp for Tizen prior to v2.18.15

How Pegasus Spied Using WhatsApp?

NSO Group clarified claiming that it has only sold Pegasus to government agencies. Moreover, the Israeli company said that the software is not designed for spying on human rights activists and journalists.

The spyware has been earlier reported of gaining complete access to users’ smartphones even with a missed voice call on WhatsApp. Any information such as emails, text messages and contact list can be retrieved by hackers after Pegasus is installed on the smartphone. 

The social media giant describes the breach as a buffer overflow vulnerability in WhatsApp’s voice over internet protocol (VOIP) stack that allowed remote code execution. In May this year, Pegasus left over 1.5 Bn WhatsApp users across the world vulnerable to its attack using the WhatsApp’s voice calling function.

WhatsApp had urged its users at the time to update to the latest app version. The social media company highlighted that few older versions of its app have security loopholes which might help the entry of malware such as Pegasus for spying.