Pegasus Spyware: Indian Government to Audit WhatsApp Security System

The Indian government plans to carry out an audit of the WhatsApp security system after the leak that the vulnerabilities in WhatsApp application were used to attack 1,400 WhatsApp users worldwide, of which almost 121 users were from India.

Ravi Shankar Prasad announced the government's plans to audit WhatsApp, Minister of Electronics and Information Technology, told Parliament on Thursday. The Indian Computer Emergency Team (CERT-In) "sought submission of information from WhatsApp on November 9, 2019, including a need to conduct an audit and inspection of WhatsApp's security systems and processes," as reported by Reuters.

While addressing Parliament, Prasad said that while WhatsApp had responded to CERT's questions, the agency had sought additional information from the company on November 26, 2019, after the company's response to the agency's requests on November 18, 2019. He also said that CERT had also sought information from the Israeli cybersecurity firm, the NSO Group, to provide details on the effect that its malware has been used to attack Indian journalists and social activists on November 26, 2019.

The IT Minister also told the Rajya Sabha members that the Indian government along with the governments of the USA, the UK and Australia was in talks with WhatsApp to identify the source of the messages and videos that contain violence.

"If there is provocation from any messages or communal violence happens, then you would have to tell the origin, who have started it. We are having discussions with them," Prasad said, PTI reported.

Last month, NSO Group's Pegasus software was used to exploit vulnerabilities in WhatsApp and target 1,400 people worldwide, including 121 Indians. "In May 2019 we stopped a highly sophisticated cyber-attack that exploited our video calling system to send malware to the mobile devices of several WhatsApp users," read WhatsApp official website.

Facebook sued the NSO Group claiming that it used WhatsApp to spread malware to the phones of people worldwide which included social activists, government officials, journalists, diplomats and politicians. Later NSO employees sued Facebook for blocking their private Facebook and Instagram employees.