[danso]

At the time, FB said it didn't believe the bug had been exploited: In this instance there is no reason to believe users were impacted. [0] The alleged hack of Bezos happened in May 2018, about 18 months after the Nov 2019 bug fix. I wonder if FB's statement was just boilerplate PR or if they really did substantial forensics to have "no reason to believe users were impacted".

[0] https://nakedsecurity.sophos.com/2019/11/20/update-whatsapp-...

[penagwin]

Anecdotal, but a lot of times phrases similar to that are used because the real answer is "We don't have any way of knowing if users were actually impacted" and it's obviously far better for PR to phrase it that way.

[BelleOfTheBall]

It does sound better but here's the thing: this is Jeff Bezos. He's one of the most high-profile people on the planet. If his phone was hacked through WhatsApp, he clearly filed a complaint and told them what had happened. They just didn't manage to patch it for over a year and then stated they 'had no way of knowing' even though this clearly proves it happened.

[moralestapia]

s/after/before/

[khc]

do you mean 18 months before?

[Thorrez]

As I mentioned in my other comment, I see no reason to think that CVE-2019-11931 was exploited by NSO Group.