whatsApp Latest Zero Day Bug

Recently Whattsap suffered from a Buffer Over Flow zero Day bug which was exploited by Israeli Company NSO Group which is well known in creating advanced Zero Days Exploits. NSO Group found this bug and installed Pegasus Spyware on various Android and IOS Devices for surveillance Purpose.

Whattspp has patched the Vulnerability on Same day when it was discovered.

How this (CVE-2019-3568) Bug Works ?

Attacker Sends a specially crafted series of SRTCP packet to victim phone and target phone’s Wattsapp VOIP stack buffer overflow vulnerability allow attacker to install “Pegasus Spyware” on the target phone by just placing a whatsapp audio and video call. After the malware is installed on phone malware takes control of the phone like your contacts, messages,calls list, camera, photographs,private chats and etc. This Bug is Discovered by Israeli Company NSO Group who works with Intellegence companies for surveillance related matters.

Pegasus spyware is been used to hack journalists, lawyers, and other high profile Politicians.

Facebook came up with an official advisory on this vulnerability which says that WhatsApp VoiP stack allows remote attackers to execute arbitrary code on target phones by sending a specially crafted series of SRTCP Packets remotely.

Official Advisory by Facebook

CVE-2019-3568

Description: A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of SRTCP packets sent to a target phone number. Affected Versions: The issue affects WhatsApp for Android prior to v2.19.134, WhatsApp Business for Android prior to v2.19.44, WhatsApp for iOS prior to v2.19.51, WhatsApp Business for iOS prior to v2.19.51, WhatsApp for Windows Phone prior to v2.18.348, and WhatsApp for Tizen prior to v2.18.15. Last Updated: 2019-05-13

“Facebook have not reveled the exact number of Users which were affected by this Attack.”

By admin

Leave a Reply

Your email address will not be published. Required fields are marked *