Encrypted Messaging Platforms Still Under Attack

Global Encryption Day is an annual day of action when advocates, champions, and everyday people come together to celebrate, promote, and defend encryption, a key security approach that enables safe online experiences. Encryption is a critical piece of the cybersecurity puzzle, keeping messages safe in transit and data safe once it is stored on a server. What happens, though, when the very platforms hosting encrypted messaging services are under attack?  

One particularly virulent threat to encrypted messaging services is the commercial spyware industry that relies on hacking tools sold by a shadowy global marketplace for digital vulnerabilities such as NSO Group’s Pegasus. Some companies have fought back against the entities selling these hacking tools. For example, in 2019 NSO Group came under fire when Meta’s WhatsApp (an end-to-end encrypted messaging service) sued NSO Group for hacking its servers to target customer devices. The suit alleges that NSO Group created WhatsApp accounts, and its engineers broke through certain digital walls to access the code undergirding the communication application. This Global Encryption Day, EPIC takes a retrospective look at how NSO Group and other companies selling hacking tools have been poking holes in our encrypted communications infrastructure.  

The Threat Posed by NSO Group and the Spyware Industry at Large 

Commercial spyware is a persistent national security threat. Sensitive military and government operations occur over highly secured phone networks and encrypted computer servers, making military and government official communications a highly sensitive and sought after commodity by bad actors. Hacking tools circumvent privileged access systems that are required to make encryption works, such as compromising access to the keys or decryption systems. Once circumvented, the data protected (both while at rest in storage or in transit between computers) is compromised.  

One of the key players in the commercial spyware industry, NSO Group, has been embroiled in scandal after scandal. NSO Group is a software company that provides government clients superpowered hacking tools. Instead of interfacing directly with telecommunication carriers and digital network owners, NSO Group staffs a group of engineers whose sole purpose is to reverse engineer and hack into various networks to gain access to target phones. Once the engineers find a door, they crack it wide open and send through malicious code to download the Pegasus software onto the target device. Once on the device, Pegasus can create a digital copy of all the data on the device; intercept and record phone calls, text messages, and any other activity occurring on smartphones; turn on microphones and cameras; and even remove traces of its activity to hide its tracks. This all-encompassing infiltration goes beyond the narrow surveillance possible with the wiretap technology of the past—this listening device can capture your entire life by gaining complete access to and control of your device while you’re none the wiser. NSO Group isn’t the only company doing this, with a growing industry of hacking companies including Paragon Solutions, Intellexa, and others offering similar phone penetration and monitoring services. 

The most chilling aspect of this infection method is that it can be installed without the victim even clicking a link or responding to a malicious email. The developers of these hacking tools have found ways to take advantage of vulnerabilities in cloud services and other ways to intercept or modify messages and calls made via smartphone app. Targets may never know their phone has been hacked and monitored on an ongoing basis. WhatsApp, Google, and Apple have made efforts to engage in threat notifications when the companies are able to catch suspicious activity, but even this system is not fool proof.  

Governments, including the United States, have been using and stockpiling hacking tools and vulnerabilities for their own intelligence and counterintelligence actions. This hacking and exploitation of the encrypted communications infrastructure to target individuals flies in the face of cybersecurity standards. While engaging in offensive intelligence actions, governments are instead creating opportunities for bad actors to hack into our own infrastructure.  

There is no backdoor that can only be opened by the “right” or “good” actors that is not also accessible to bad actors. Once a security vulnerability is found or created, there is no way to stop malicious users from walking through the door other than hiding its existence or patching it so no one can get through. The existence of groups like NSO Group threaten our national security by looking for these holes and poking new ones into our infrastructure. These holes then give access to phones and computers which hold our most sensitive data. 

We have already seen the severe threats to national security and to telecommunications infrastructure that have been caused by these vulnerabilities. For example, the legally entitled backdoor in American call carrier infrastructure used by law enforcement to engage in legal wiretaps was the door used to execute one of the biggest data breaches in American history (that may still be ongoing according to the FCC). The telecom companies have internal security teams as well as external bug bounty programs, but it’s a game of whack a mole trying to keep bad actors out.  

This practice of opening doors in our infrastructure to wiretap high risk individuals makes our security web more akin to Swiss cheese than a Kevlar vest. Bad actors have a vested interest in finding and acquiring those vulnerabilities in our infrastructure. In fact, an American defense contractor was recently indicted for selling these very security vulnerabilities to a broker with ties to the Russian government. State department officials, members of the military, congress members, and their staff have been targeted with commercial spyware.  These harms are not theoretical: they are already affecting us.

Not only does offensive cyber-vulnerability market target sensitive government actors, the hacking of computer infrastructure is also flatly illegal under the Computer Fraud and Abuse Act (CFAA). The CFAA criminalizes the hacking of computers, either without any prior authorization or by exceeding authorization granted by the computer owner. By making accounts for the purpose of sending malicious code (violating WhatsApp’s terms of service), accessing information about WhatsApp users, and reverse engineering security vulnerabilities in WhatsApp’s code, NSO Group exceeded authorized access given by WhatsApp during the creation of standard accounts. WhatsApp engaged in a years-long legal battle against NSO Group, eventually triumphant when the judge found NSO Group liable for its 2019 hacking activities.  

Companies that refuse to follow U.S. laws should not be allowed to benefit from U.S. business agreements 

There has been a recent spotlight on the vulnerabilities market—governments and bad actors are paying exorbitant prices for zero-day exploits (security vulnerabilities that the company has had zero days to remediate) and encryption work-arounds to access sensitive information. With a booming market, there is little incentive to cut back on the “move fast and break things” mentality to hack into government officials and journalists phones. Most recently, spyware companies have also moved from telecommunications infrastructure to the multi-billion dollar advertising industry.  

In 2021, the U.S. government acknowledged the reality of the threats posed by commercial spyware and placed NSO Group on an entity list, a federally maintained list of companies that are not permitted to do business with American companies. This closely followed the hacking of 9 State department officials’ devices and 2 Congress members and their staff getting hacked. Executive Order 14093 also came into effect in 2023, preventing the U.S. Government from using commercial spyware that presents a counter-intelligence risk to the United States. Despite this, NSO Group recently came under fire for flouting a permanent injunction and creating more WhatsApp accounts. These companies are flagrantly violating American laws and courts to infiltrate communications infrastructure. 

NSO Group and its ilk clearly pose a continuing national security risk, and the industry has a proven track record of attacking both American infrastructure and American government officials while ignoring the legal system’s demands. There has been no change in behavior since the sanctions nor the executive order. Just last year, NSO Group was acquired by a U.S. investor with seemingly no ties to the defense industry and a new CEO was appointed. This acquisition, along with various meetings in Washington, D.C., are rumored to be connected to a bid to remove NSO Group from the sanctions list, allowing it to sell in the United States again.  

NSO Group isn’t the only bad actor in this space—other companies in the hacking business like Intellexa, Paragon, and others provide the exact same style of penetration software to governments that rely on exploiting telecommunications and technology infrastructure to attack victim’s devices. These hacking tools all present similar threats to our national security and legal system.  

Various forms of encryption continue to be the gold standard for safely communicating sensitive military, government, and personal matters. Focusing America’s cyber strategy on offensive work and deputizing private companies to worsen this industry is not the right move. The U.S. government needs to step up and push back against the industry intent on fundamentally weakening baseline cyber protections.