.png)
What is Pegasus Spyware and how does it get in?
As the COVID19 pandemic intensifies, the need for safe and secure communication is important as the internet and digital media are the prime means through which we communicate to the world outside our homes. The emergence of social media and other shapes of digital communication has raised a fundamental need for privacy. This has drawn center stage because most communication moves through the public internet where it can be revealed unless precautions are taken to protect the contents of the message.
More often than not, users want only their recipients to acknowledge their message and not anyone who nose around for information. This intuitive need for privacy gave rise to the emergence of the technology called “end-to-end encryption” or E2EE, a technology that ensures the senders and receivers can understand the message alone, which means anyone who intercepts the messages in between, cannot read them. This made most of the businesses challenging as many employees are working from home, transmitting and receiving sensitive information.
Among the companies whose apps and services use E2EE are Facebook, Google, Twitter, Yahoo, Microsoft, and Dropbox. E2EE is good for protecting your privacy but some governments are not happy about this because it is hard for them to spy on people especially when tracking terrorists and criminals or as some governments have known to do, snooping on subversive, protesters and journalists. NSO group- an Israeli technology firm, generated their flagship product, Pegasus. A spyware that can stealthily enter a smartphone and acquire access to everything including its camera and microphone. It is designed to invade devices running around Android, Blackberry, iOS, and Symbian operating systems and turn them into surveillance devices. The company stresses out that this technology is sold exclusively to governments for the objectives of tracking criminals and terrorists.
How does Pegasus Works?
Once the Pegasus is installed, it can theoretically collect any data from the device and transmit it back to the attacker. It can steal videos, photos, records, communications, recordings, passwords, call logs, to name a few. It is capable of activating cameras and microphones for real-time surveillance without the permission and knowledge of the user.
The early versions of Pegasus were installed on smartphones by spear-phishing, which involves tricking a targeted user into clicking a link or opening a document that secretly installs the software. Also, it can be installed over a wireless transceiver located near the target. Going back to 2019, Pegasus users can install the software on smartphones with a missed call on WhatsApp and delete the record of the missed call so that the owner of the phone does not know anything that is missed on the device. Another way also is by sending a message to a user’s phone with no notification. But the latest version of the spyware does not require the user to do anything. All that is required is to have a particularly vulnerable app or operating system installed on the device for a successful spyware attack. This is called a zero-click exploit.
NSO group stated that they built Pegasus merely for governments to use it in counterterrorism and law enforcement work. It is promoted as a spying tool to track criminals and terrorists, not for mass surveillance. The company does not disclose its clients. The earliest record of use was by the Mexican government in 2011 to track the notorious drug magnate Joaquin” El Chapo” Guzman. This tool was also used to track people close to murdered Saudi journalist, Jamal Khashoggi. It is ambiguous of who or what type of people are targeted and why. Much of the recent reports about Pegasus are based on a list of 50, 000 phone numbers. This list has been attributed to the NSO Group and its origin is unclear. According to Amnesty International in Israel, “ the list contains phone numbers that were marked as “of interest” to NSO’s valued clients, though it’s not known if any of the phones associated with numbers have been tracked.
The Pegasus Project- a media consortium, analyzed the phone numbers on the said list and identified over 1,000 people in over 50,000 countries. These findings include people who fall outside of the NSO’s restriction to investigate criminal and terrorist activity that involves government workers, politicians, journalists, human rights activists, Arab royal family members, and business executives.
The ability of Pegasus is breathtaking to take complete control of someone’s phone but it's not the only way. Some can aid surveillance and undermine privacy that includes eavesdropping, malware, location tracking, and collecting data from sensors. A phone’s location is tracked by the government and phone companies by tracking signals from cell towers. Wifi and Bluetooth signals can track phones. In other cases, apps and web browsers can track the phone’s location.
“The National Security Agency has sought agreements with technology companies under which the companies would give the agency special access into their products via backdoors, and has reportedly built backdoors on its own. The companies say that backdoors defeat the purp[ose of end-to-end encryption. The good news is, depending on who you are, you’re unlikely to be targeted by a government-wielding Pegasus. The bad news is, that fact alone does not guarantee your privacy.” - The Conversation
Sources:
About the Writers:
Marie Rosales is a professional in the field of security. She is currently a full-time Content Writer and AVCreativity Studio's Virtual Assistant. She enjoys cooking and reading. She spends most of her spare time with her children.
Pamela Elizabeth, Editor-in-Chief at AVCreativity Studio. Earned a Bachelor’s Degree of Secondary Education Major in English. She loves going on little adventures alongside reading good books. She is enthusiastic about her work and ensures that her clients receive the finest service possible.
