Constant improvement of security mechanisms, elimination of various vulnerabilities and implementation of other measures make hacking mobile devices based on iOS and Android, as well as major applications for them, an expensive activity. That’s why hacking techniques for popular apps like WhatsApp are now worth millions of dollars.
Late last month, Operation Zero, which positions itself as a Russian platform that purchases new hacking plans from information security researchers, announced that it was willing to pay between $200,000 and $20 million for plans that would compromise iOS and Android devices. These are high-level exploits that are possible to exploit because developers have not yet patched the vulnerabilities associated with them in their products.
The source also points out the increasing cost of hacking individual mobile applications. The report stated that the price of a new plan to hack the Android version of WhatsApp messenger, which provides access to the victim’s chats, ranged from $1.7 million to $8 million as of 2021. Mostly government hackers hacking zero-day vulnerabilities.
In 2019, researchers identified several NSO Group customers using the Israeli company’s software to infiltrate WhatsApp on victims’ devices. Shortly thereafter, WhatsApp sued NSO Group, accusing the company of creating and distributing tools used to track hundreds of messenger users. According to the source, the company was selling a remote code execution vulnerability that developers did not know about for approximately $1.7 million in 2021.
In the case of WhatsApp, this vulnerability allows hackers to create an exploit that does not require interaction with the victim. NSO Group’s exploit ran in WhatsApp mobile clients for Android from versions 9 to 11 and exploited a vulnerability in the image processing library. Between 2020 and 2021, WhatsApp developers fixed three image processing vulnerabilities in messaging. However, it is not known whether the vulnerability used by NSO Group has been patched. Official representatives of the company refused to comment on this issue. Source