Some documents for the trial of WhatsApp against NSO Group were unsealed and collected on DocumentCloud. In WhatsApp’s motion for summary judgment NSO admits that its zero-click vector Eden, part of a WhatsApp vector family called Hummingbird, was behind the attacks on roughly 1,400 devices in May 2019. WhatsApp’s opposition to NSO’s own motion follows an IP address hardcoded into the exploit messages, used at least 700 times, to a QuadraNet server in California. The reply brief holds NSO to its own records: the 2018 WhatsApp security updates completely disabled the earlier Heaven vector, and NSO got the 403 error to prove it.
Reading through the documents the following events transpired:
- NSO intentionally accessed WhatsApp’s servers and the target devices
- NSO accessed WhatsApp Servers and the Official Client on Target Devices without authorization or exceeded any purported authorized access.
- NSO bypassed the restrictions built into the official client.
- NSO circumvented plaintiffs’ 2018 security updates.
- NSO developed, tested, and used a WhatsApp malware vector after plaintiffs filed this action and revoked NSO’s access.
- NSO exceeded any purported authorization to access WhatsApp’s server.
- NSO accessed target devices without authorization.
TechCrunch’s write-up of the filings names the three WhatsApp exploit vectors (Heaven, Eden and the zero-click Erised, which WhatsApp only blocked in May 2020, months after filing suit) and notes NSO’s admission that it cut off 10 government customers for abusing Pegasus.
The opposition also includes some details about the operational security of NSO Group:
Greencloud’s records indicate that the 104.223.76.220 IP address was leased in 2019 to a “Lisa Hoover,” who paid in Bitcoin and registered with a Gmail account. — DocumentCloud
NSO admits to paying in Bitcoin for anonymized VPS and to using Gmail for anonymized accounts, and since only NSO could have hardcoded that IP address into the exploit messages, WhatsApp argues NSO leased the QuadraNet server too.