The Million-Dollar WhatsApp Zero-Day Game
The Million-Dollar Race for WhatsApp Zero-Days
In the ever-evolving landscape of cybersecurity and digital warfare, the game has become exponentially more expensive. This shift has been most apparent in the astonishing worth of zero-day exploits, especially when it comes to the world's most popular messaging app, WhatsApp. In recent years, hacking techniques targeting WhatsApp have skyrocketed in value, with prices reaching mind-boggling millions of dollars. The reason? The convergence of advanced security mechanisms and significant improvements in mitigations.
As the demand for these prized zero-days grows, TechCrunch has learned of a Russian company's jaw-dropping offer last week: a staggering $20 million for a chain of vulnerabilities that could remotely compromise smartphones running both iOS and Android. These exploits, the company declared, were exclusively intended for "Russian private and government organizations." The hefty price tag is partially attributed to the complex geopolitical climate, which has made many security researchers hesitant to collaborate with Russia. With the ongoing situation in Ukraine, Russian government clients are willing to pay a premium to fulfill their digital objectives.
Nevertheless, the soaring value of zero-days isn't limited to Russia alone. Even beyond its borders, prices have seen a remarkable surge. Leaked documents uncovered by TechCrunch tell a riveting story. In 2021, a zero-day exploit capable of compromising WhatsApp on Android and accessing message content was valued between $1.7 million and $8 million.
"The prices have shot up," affirmed an anonymous security researcher with insider knowledge of this clandestine market. Due to their sensitivity, the researcher requested anonymity when speaking to the press.
WhatsApp has emerged as a prime target for government-backed hackers, particularly the kind of groups that have the means to utilize zero-days effectively. In 2019, researchers exposed customers of the controversial spyware company NSO Group employing a zero-day to target WhatsApp users. Following this revelation, WhatsApp took legal action against the Israeli surveillance technology vendor, accusing it of exploiting the platform to enable over a thousand WhatsApp users to fall victim to the zero-day attack.
One of the leaked documents from 2021 uncovered a company selling a "zero-click RCE" in WhatsApp for roughly $1.7 million. RCE, short for remote code execution, is a critical cybersecurity vulnerability that allows malicious hackers to run code on the target's device. In this case, it granted access to WhatsApp, enabling the monitoring, reading, and extraction of messages. The term "zero-click" underscores the exploit's stealthiness, as it doesn't require any interaction from the target, making it exceptionally difficult to detect.
According to the document, this particular exploit worked on Android versions 9 to 11, released in 2020, capitalizing on a flaw in the "image rendering library." WhatsApp had addressed three vulnerabilities in 2020 and 2021—CVE-2020-1890, CVE-2020-1910, and CVE-2021-24041—all related to image processing. It remains uncertain if these patches successfully eradicated the underlying vulnerabilities of the exploits offered for sale in 2021.
WhatsApp has remained tight-lipped on the issue, with spokesperson Zade Alsawah declining to comment.
What makes WhatsApp an alluring target is that government hackers, often working for intelligence or law enforcement agencies, might solely be interested in accessing a target's WhatsApp chats without the need to compromise the entire phone. However, an exploit limited to WhatsApp can also serve as a crucial link in a chain aimed at further compromising the target's entire device.
In the clandestine world of cyber warfare, the motives for acquiring these exploits are crystal clear – they enable espionage on a grand scale. As the security researcher with insight into this covert market asserts, "If the exploit they buy does not give them all of what they want, they need to buy multiple pieces and combine them."
The value of zero-days, particularly in the context of WhatsApp, has reached unparalleled heights, making it a fascinating and concerning testament to the evolving landscape of digital security. With demand soaring and prices skyrocketing, the world of cybersecurity remains as unpredictable as ever, as defenders and attackers continue to play a high-stakes game.