Facebook vs NSO Group lawsuit: 1,400+ users were targeted with Pegasus spyware

The legal dispute between Facebook and NSO group continues even after the Israeli surveillance firm filed a motion to dismiss the case earlier this month. Facebook advocates have challenged a plea from spyware maker NSO Group to dismiss the legal dispute over the hacking accusations, arguing it has immunity from prosecution. Now both companies are […]

April 25, 2020

The legal dispute between Facebook and NSO group continues even after the Israeli surveillance firm filed a motion to dismiss the case earlier this month.

Facebook advocates have challenged a plea from spyware maker NSO Group to dismiss the legal dispute over the hacking accusations, arguing it has immunity from prosecution.

Now both companies are providing technical details requested by the cyber-security experts. according to court documents shared by ZdNet, Facebook linked at least 720 attacks against WhatsApp users to one single IP address.

The surveillance implant used by the NSO group used an exploit for a vulnerability, tracked as CVE-2019-3568, in the WhatsApp VoIP feature.

The attacks took place in the spring of 2019, Facebook states that more than 1,400 users were targeted with the NSO Pegasus spyware, including, journalists, human rights activists, political dissidents, diplomats, attorneys, and government officials.

“I have reviewed the malicious code sent during the attack described in the Complaint. That malicious code was designed to cause a WhatsApp user’s mobile device to connect to a remote server not associated with WhatsApp. The IP address of the remote server was included in the malicious code,” explained Claudiu Gheorghe, a software engineering for WhatsApp.

“In 720 instances of the attack, the remote server’s IP address was 104.223.76.220. In 3 instances of the attack, the remote server’s IP address was 54.93.81.200,”

In April, attorneys for the NSO Group filed a motion to dismiss the hacking case, among the observations raised by the advocates there was the lack of jurisdiction of a California court to preside over the case, but investigators pointed out that the IP address 104.223.76.220 belongs to QuadraNet Enterprises LLC, a data center provider in Los Angeles.

Facebook attorneys also remarked that the NSO group is also financed by a California private equity firm.

“To execute its scheme and install its spyware on WhatsApp users’ devices, NSO separately entered into a contract with a California-based technology company, QuadraNet, that included a California choice-of-law clause,” Facebook said.

The NSO attorneys always remarked that the surveillance firm should be immune to prosecution because it was contracted by a foreign government, but the Facebook legal team refused this justification, there is no immunity granted to organizations involved in surveillance activities committed by foreign states.