TIMES.KY

Cayman Islands, Caribbeanand International News
Thursday, Mar 28, 2024

How to Search for, Spot and Stamp Out Pegasus Spyware From Your Phone

How to Search for, Spot and Stamp Out Pegasus Spyware From Your Phone

The powerful Israeli military-grade spyware made international headlines on Sunday, when media investigations discovered that at least 50,000 people across more than a dozen nations had their cellphones targeted in sophisticated hack attacks that stole information and turned devices into mobile bugs.

Governments, journalists, opposition politicians and rights groups worldwide are demanding a formal inquiry into Pegasus, the spyware product created by shadowy Israeli software company NSO Group. Sold to states to ‘fight terrorism and crime’, the software has been discovered to have been used in unscrupulous ways to target members of the press, lawmakers and others, helping to stamp out dissent or allow governments to get ahead of potentially embarrassing scandals.

How It Works


Pegasus is not your typical one-click piece of malware which requires user interaction – usually by following on a malicious link - to get access to a device. Instead, the spyware infects phones through a so-called zero-click attack, which needs no interaction from the user and simply installs itself and starts harvesting data.

Once installed, the spyware, which is compatible with both Android and Apple iOS, can gain access to all manner of data on a user’s phone, from contacts and encrypted messages to call records, photos, and GPS location data. What’s more, it’s capable of turning microphones and cameras on or off remotely, thus turning the user’s device into a mobile listening or viewing device.

To conceal its presence, Pegasus minimises bandwidth consumption to avoid draining the battery and raising user suspicions. Instead, it sends regular scheduled updates to command and control servers (C2s) – the computers or domains used by whoever is doing the spying. Unfortunately, the spyware is also impervious to commercially available antivirus software.

How to Check for Pegasus?


The spyware’s inconspicuous nature, its zero-click installation, and imperviousness to antiviruses makes it virtually impossible for phone owners to detect its presence simply by observing their device.

There’s hope, however. Because the software connects to the aforementioned C2s, a search to determine whether or not a phone communicated with known Pegasus installation servers can theoretically detect whether the malware is present.

Amnesty International, the London-based human rights organisation that helped media blow the lid off the extent of Pegasus’ spread in this weekend’s reporting, identified compromised iPhone devices by studying the records of process executions and network usage performed the phones’ database files - datausage.sqlite and netusage.sqlite.

Amnesty’s analysis found a total of 45 suspicious process names in their analysis, with Citizen Lab, a University of Toronto-based software developer working to protect citizens against surveillance, matching 28 of these processes in their own independently conducted inquiry.

Technology giants such as Apple, and app-makers such as Facebook’s WhatsApp, haven't simply been sitting on their hands while Pegasus runs amok on their devices and software since the spyware was first discovered in 2016, and have sought to close security breaches once they are found. This is one reason NSO Group has worked to develop new versions of its spyware. Unfortunately, the Israeli spyware giant appears to have remained one step ahead of companies such as Apple for the moment, with Citizen Lab research fellow Bill Marczak reporting on Monday that the latest version of iOS, version 14.6, is still vulnerable to Pegasus’ zero-click attacks.


Users can independently scan their phones for signs that their device has been compromised using Amnesty’s ‘indicator of compromise’ (IoC) toolkit. The software, formally known as the ‘Mobile Verification Toolkit’ or MVT, works with both iOS and Android, and is available for download here.

In its current form, the software is not an easy-to-use experience, has no graphical user interface, and installs on phones’ command line, meaning that basic knowledge of basic coding is needed (details here). The toolkit also requires the download and installation of dependencies to operate.

Once installed, the software allows users to create a backup of their device, check backup files, including artefacts from iTunes’ proprietary backup system, if applicable, extract artefacts from filesystem dumps, and compare stored data with known indicators of compromise. The Android version of the software, which Amnesty says is less fleshed out because of Pegasus’ greater prevalence on iOS devices, includes the ability to check for the download of non-safelisted APKs (apps), and to search for backups for text messages with links to the roughly 700 known NSO domains (Amnesty says this list will be continually updated).

TechCrunch contributor Zack Whittaker tested out the toolkit on an iPhone, and reported that it takes about 10 minutes to get it up and running, plus the time it takes to back up the phone, which is necessary to decrypt locally stored files. The scan itself takes just one to two minutes, and lists possible signs of compromise in the outputted files.

You’ve Got Pegasus – What Now?


Tech experts don’t make it explicitly clear what can be done if Pegasus is found on a device. In a 2019 study, Citizen Lab found that in the case of Android devices, the malware can survive a factory reset on some phones, meaning that the only way to be sure you’re not infected is to get a new phone.

It’s not clear whether NSO Group’s software can survive a hard reset on iOS devices, with Apple tech support reluctant even to admit that its advanced “sandboxed iOS architecture” can be compromised, and recommending software updates to deal with the problem (they don't).

Tech specialists don’t mention it, but another possible way to reduce exposure to Pegasus is to reduce one’s exposure to the digital world.

Journalists, activists, politicians and others who feel vulnerable can do so by using landlines or simple button phones with no internet capabilities for Pegasus to exploit, by engaging in face-to-face meetings instead of voice and text message conversations, using analogue or simple digital voice recorders, etc. If giving up your smartphone is not an option, there’s always the alternative of using a non-Android, non-iOS smartphone, which may be less vulnerable to the Israeli spyware by virtue of its more limited user base.

None of these techniques can guarantee that whoever may be monitoring you illegally won’t be able to do so, but it will at least require a greater effort on their behalf to do so.

Newsletter

Related Articles

TIMES.KY
0:00
0:00
Close
Paper straws found to contain long-lasting and potentially toxic chemicals - study
FTX's Bankman-Fried headed for jail after judge revokes bail
Blackrock gets half a trillion dollar deal to rebuild Ukraine
Israel: Unprecedented Civil Disobedience Looms as IDF Reservists Protest Judiciary Reform
America's First New Nuclear Reactor in Nearly Seven Years Begins Operations
Southeast Asia moves closer to economic unity with new regional payments system
Today Hunter Biden’s best friend and business associate, Devon Archer, testified that Joe Biden met in Georgetown with Russian Moscow Mayor's Wife Yelena Baturina who later paid Hunter Biden $3.5 million in so called “consulting fees”
Singapore Carries Out First Execution of a Woman in Two Decades Amid Capital Punishment Debate
Google testing journalism AI. We are doing it already 2 years, and without Google biased propoganda and manipulated censorship
Unlike illegal imigrants coming by boats - US Citizens Will Need Visa To Travel To Europe in 2024
Musk announces Twitter name and logo change to X.com
The politician and the journalist lost control and started fighting on live broadcast.
The future of sports
Unveiling the Black Hole: The Mysterious Fate of EU's Aid to Ukraine
Farewell to a Music Titan: Tony Bennett, Renowned Jazz and Pop Vocalist, Passes Away at 96
Alarming Behavior Among Florida's Sharks Raises Concerns Over Possible Cocaine Exposure
Transgender Exclusion in Miss Italy Stirs Controversy Amidst Changing Global Beauty Pageant Landscape
Joe Biden admitted, in his own words, that he delivered what he promised in exchange for the $10 million bribe he received from the Ukraine Oil Company.
TikTok Takes On Spotify And Apple, Launches Own Music Service
Global Trend: Using Anti-Fake News Laws as Censorship Tools - A Deep Dive into Tunisia's Scenario
Arresting Putin During South African Visit Would Equate to War Declaration, Asserts President Ramaphosa
Hacktivist Collective Anonymous Launches 'Project Disclosure' to Unearth Information on UFOs and ETIs
Typo sends millions of US military emails to Russian ally Mali
Server Arrested For Theft After Refusing To Pay A Table's $100 Restaurant Bill When They Dined & Dashed
The Changing Face of Europe: How Mass Migration is Reshaping the Political Landscape
China Urges EU to Clarify Strategic Partnership Amid Trade Tensions
Europe is boiling: Extreme Weather Conditions Prevail Across the Continent
The Last Pour: Anchor Brewing, America's Pioneer Craft Brewer, Closes After 127 Years
Democracy not: EU's Digital Commissioner Considers Shutting Down Social Media Platforms Amid Social Unrest
Sarah Silverman and Renowned Authors Lodge Copyright Infringement Case Against OpenAI and Meta
Italian Court's Controversial Ruling on Sexual Harassment Ignites Uproar
Why Do Tech Executives Support Kennedy Jr.?
The New York Times Announces Closure of its Sports Section in Favor of The Athletic
BBC Anchor Huw Edwards Hospitalized Amid Child Sex Abuse Allegations, Family Confirms
Florida Attorney General requests Meta CEO's testimony on company's platforms' alleged facilitation of illicit activities
The Distorted Mirror of actual approval ratings: Examining the True Threat to Democracy Beyond the Persona of Putin
40,000 child slaves in Congo are forced to work in cobalt mines so we can drive electric cars.
BBC Personalities Rebuke Accusations Amidst Scandal Involving Teen Exploitation
A Swift Disappointment: Why Is Taylor Swift Bypassing Canada on Her Global Tour?
Historic Moment: Edgars Rinkevics, EU's First Openly Gay Head of State, Takes Office as Latvia's President
Bye bye democracy, human rights, freedom: French Cops Can Now Secretly Activate Phone Cameras, Microphones And GPS To Spy On Citizens
The Poor Man With Money, Mark Zuckerberg, Unveils Twitter Replica with Heavy-Handed Censorship: A New Low in Innovation?
Unilever Plummets in a $2.5 Billion Free Fall, to begin with: A Reckoning for Misuse of Corporate Power Against National Interest
Beyond the Blame Game: The Need for Nuanced Perspectives on America's Complex Reality
Twitter Targets Meta: A Tangle of Trade Secrets and Copycat Culture
The Double-Edged Sword of AI: AI is linked to layoffs in industry that created it
US Sanctions on China's Chip Industry Backfire, Prompting Self-Inflicted Blowback
Meta Copy Twitter with New App, Threads
The New French Revolution
BlackRock Bitcoin ETF Application Refiled, Naming Coinbase as ‘Surveillance-Sharing’ Partner
×