What is WhatsApp spyware & why you should update the app

WhatsApp, the most popular messaging app with almost 1.5 million billion users, had a spyware vulnerability that was discovered by the company earlier this month. Since then, the company has asked users to update the app as soon as possible to deal with the hack. But what is this spyware?

What does the spyware do?

The spyware was created by Israeli company NSO Group, said a Financial Times report, which broke the story. The software could install and spread to Android, iOS, Windows and Tizen devices. Though the vulnerability has now been fixed by WhatsApp, it’s unclear how many users were affected by it, and if there was any malicious action taken by the group that came up with this surveillance spyware.

How did it spread?

You could get it from any WhatsApp or WhatsApp Business user — whether they are in your contact list or not — and it’s transferred through voice calls, regardless of whether you answer the call or not. What’s more, such calls would get deleted from your WhatsApp call history automatically, so it was even harder to tell whether a person’s phone was affected or not. And if it was, how or when it got the spyware. Once the spyware was installed on your smartphone, it apparently trawled and shared your phone data to a remote server.

What is NSO?

NSO, the infamous company behind this spyware, has several surveillance products in its arsenal. For instance, it has something called Pegasus, which, if installed on your phone via a malicious URL, can track not only your phone’s location but also scan through your messages and emails. The company is known in the hacking community for unlocking stolen iPhones that are locked with a pin or password. According to a Guardian article, NSO mostly tracks activists, lawyers and journalists from across the world.

Read more: WhatsApp confirms a spyware attack

Why should I update my app?

“WhatsApp encourages people to upgrade to the latest version of our app, as well as keep their mobile operating system up to date, to protect against potential targeted exploits designed to compromise information stored on mobile devices,” WhatsApp said in a statement.

Many security researchers try to find such vulnerabilities in order to contact the relevant company or group to get them fixed. Often, large tech companies reward such researchers who bring to light such issues under something called bounty hunter programmes. Many times there are 0-day security issues that plague a popular app or platform, so this isn’t something new. Apple’s macOS or Google’s Chrome browser may have such security holes but not every single issue gets out. The quicker an issue gets patched, the better it is for the users.

This is why it’s important to use the latest version of the app. Also, it’s important to not click that shady URL some unknown person sends you over WhatsApp, for it could be some kind of malware or download some kind of spyware that shares your data remotely in the background.

(The author is a freelance tech writer.)