The Whatsapp hack is interesting if not for anything else but being based on something I had written, more than a year ago, in Sultan of Delhi 2. Wish I had published it then for a Jules Verne moment.
Anyways, what has happened now is this. The Pegasus "attack suite" has been known, for some years now, to be the world's most sophisticated malware. The developers have, according to legend, several zero-day exploits on all OSs that they use to gain control over target phones
Zero day exploits are exploitable vulnerabilities in commercial software (typically operating systems like iOS and Android) that allow malware to escalate privilege (i.e. do stuff they are not allowed to do). It takes nation-state-like resources to find zero day exploits.
Pegasus, made by a Israeli company called NSO, has used zero-day exploits before, but usually they had to trigger it by making the target click a link (technically called spear-phishing) by creating a link the target is likely to click. With Whatsapp they have gone bigger.
By finding a zero-day within Whatsapp, they sent a video call which the target did not even have to pick up. The video call, I am guessing, triggered access to what should have been protected memory area, and Pegasus was able to get code running on the target OS
So putting it together, a zero-day in Whatsapp chained to a zero-day (or days) in iOS and Android to give the malware access to OS privileged actions, controlling the microphone, accessing contact lists and call records, and I am also guessing there is a command and control
To which the data would be streamed. Now the concern is that the parent company NSO claims to sell these tools only to government agencies. This I am skeptical of. Government agencies do not directly touch these things, but do so through intermediaries. Like ahem Arjun Bhatia.
How concerned should you be? Not at all. Whatsapp's end-to-end encryption stands. The iOS and Android zero-days I am guessing have already been fixed through patches. So has Whatsapp. The fixes are usually shockingly simple, sometimes just one line in the code-base.
But surely there are other zero-days. There is. The thing is that finding them costs millions of dollars, and when a bad actor uses them, they know using it means losing it (the vendor will fix), which means someone has to pony up *real big bucks* for them to use a Brahmastra.
Now a valid question is "are there really so many zero-days?" The answer is no. A "zero day" is like a Sachin Tendulkar or a Ponting. What is more common are exploits that use the time of discovery by community and time of fixing, which often may be weeks to deliver.
For example, in many open source projects, someone finds a vulnerability, raises a ticket. The evil guys have "eyes", they immediately create an attack. They have time till a patch is developed, patch is tested, patch rolled out to main trunk, patch delivered, patch deployed.
Often in many open source projects (e.g. Linux), a bug fix is rolled out as a "code change". If you are using the software, you yourself have to change the code, rebuild and compile, and deploy the fix. Or you can wait for next release cycle when that is fixed (months)
Most "quasi zero days" take advantage of this. The targets are usually browsers, SDKs, run-time environments, all software that does privileged operations.
