The flaw — identified as CVE-2019-11931 — made it possible for attackers to send a specially crafted MP4 file to remotely execute malicious code on the victim’s device without any intervention. In an advisory posted on its site, Facebook said: However, the presence of the flaw alone doesn’t mean it could be used for nefarious purposes. As is often the case, it can be an entry point for an exploit chain that links together a group of security vulnerabilities, thereby allowing a hacker to penetrate digital protections. When we reached out for a response, a spokesperson for the company said, “WhatsApp is constantly working to improve the security of our service. We make public, reports on potential issues we have fixed consistent with industry best practices. In this instance there is no reason to believe users were impacted.” The bug affected Android versions prior to 2.19.274, iOS versions prior to 2.19.100, Enterprise Client versions prior to 2.25.3, Windows Phone versions before and including 2.18.368, Business for Android versions prior to 2.19.104, and Business for iOS versions prior to 2.19.100. While there’s no indication that the flaw was exploited, the disclosure comes weeks after WhatsApp revealed that at least two dozen academics, lawyers, Dalit activists, and journalists in India were the target of surveillance by threat operators using security firm NSO Group’s Pegasus spyware. The social media giant has also sued the Israeli company for exploiting a now-fixed video calling flaw in WhatsApp service to surveil over 1,400 users. In the meantime, it is crucial that you update WhatsApp to the latest version to mitigate the risk of exploit.
