Russell Brandom of The Verge commented that Apple's bug-bounty program, which rewards people who manage to find faults in its software, maxes out at payments of $200,000, "just a fraction of the millions that are regularly spent for iOS exploits on the black market". The NSO Group, while disputing WhatsApp’s allegations “in the strongest possible terms”, has said that it provides the tool exclusively to “licensed government intelligence and law enforcement agencies”, and not just to anyone who wants it. News of the spyware caused significant media coverage. The NSO Group is a Tel Aviv-based cyber-security company that specialises in “surveillance technology” and claims to help governments and law enforcement agencies across the world fight crime and terrorism. According to claims in a Pegasus brochure that WhatsApp has submitted to court as a technical exhibit, the malware can also access email, SMS, location tracking, network details, device settings, and browsing history data. ", "A serious attack on the iPhone was just seen in use for the first time", "Apple issues global iOS update after attempt to use spyware on activist's iPhone", "Why can't Apple spend its way out of security vulnerabilities? Pegasus is a surveillance malware developed by the Israeli surveillance NSO Group that could infect both iPhones and Android devices, it is sold exclusively to the governments and law enforcement agencies.. Pegasus spyware’s operations were live in 45 countries at the time, The Citizen Lab research showed. Indian Activists, Lawyers Were 'Targeted' Using Israeli Spyware Pegasus. ‘Pegasus’ is a WhatsApp spyware made by NSO Group that was used to snoop into handsets. [19], Lookout provided details of the three vulnerabilities:[12], News of the spyware received significant media attention,[4][21][22][23][24] particularly for being called the "most sophisticated" smartphone attack ever,[25][26] and, for being the first time in iPhone history when a remote jailbreak exploit has been detected. Surveillance via WhatsApp: The case against Israeli spyware firm NSO, and how attack happened As per WhatsApp, NSO also “reverse-engineered the WhatsApp app and developed a program to enable them to emulate legitimate WhatsApp network traffic in order to transmit malicious code — undetected — to Target Devices over WhatsApp servers”. It was developed by the Israeli cyberarms firm NSO Group. Earlier August, Citizen Lab shared evidence of attacks against 175 targets worldwide carried on with the NSO spyware. It is not known who carried out the surveillance on the Indian targets. (A presumably newer version of the malware does not even require a target user to click a link. [1], At 2017 Security Analyst Summit held by Kaspersky Lab, researchers revealed that Pegasus exists not only for iOS, but for Android as well. Pegasus is said to be around for about three years and it is not your ordinary spyware. CVE-2016-4656: Kernel Memory corruption leads to Jailbreak – 32 and 64 bit iOS kernel-level vulnerabilities that allow the attacker to secretly jailbreak the device and install surveillance software - details in reference. Last week, WhatsApp users worldwide were surprised by the news that Facebook is planning to sue an Israel based agency named NSO Group for snooping over 1400 users through Pegasus spyware and WhatsApp application. The mention of the now discontinued mobile OS Symbian and the no longer popular BlackBerry suggests the document is old — and Pegasus has certainly been upgraded over the years. Click here to join our channel (@indianexpress) and stay updated with the latest headlines. ", "Did Indian Govt Buy Pegasus Spyware? How to prevent Pegasus malware from attacking your WhatsApp number. In an Op-ed in The Washington Post, the head of WhatsApp, Will Cathcart, wrote that the surveillance “targeted at least 100 human-rights defenders, journalists and other members of civil society across the world”. The surveillance was carried out using a spyware tool called Pegasus, which has been developed by an Israeli firm, the NSO Group. Once the phone is exploited and Pegasus installed, it begins contacting the operator’s command and control servers to receive and execute operator commands, and send back the target’s private data, including passwords, contact lists, calendar events, text messages, and live voice calls from popular mobile messaging apps. In December 2018, Montreal-based Saudi activist Omar Abdulaziz lodged a case against the NSO Group in a court in Tel Aviv, alleging that his phone had been infiltrated using Pegasus, and conversations that he had with his close friend, the murdered Saudi dissident journalist Jamal Khashoggi, snooped on. While spyware companies see an exploit purchase as a one-time payout for years of access, Apple’s bounty has to be paid out every time a new vulnerability pops up." The spyware, known as Pegasus, was created by the secretive cyber warfare firm NSO Group, one of the many high-tech startups that has emerged from Israel’s advanced military technology sector. All of this takes place without the target user’s knowledge. The Citizen Lab post said Pegasus can “send back the target’s private data, including passwords, contact lists, calendar events, text messages, and live voice calls from popular mobile messaging apps”. It employed almost 500 people as of 2017, and is based in Herzliya, near Tel Aviv, Israel. The spyware was first discovered in 2017. Once the phone is exploited and Pegasus is installed, it begins contacting the operator’s command and contr… This page was last edited on 9 December 2020, at 14:25. Posted By Naveen Goud. Those rattled by the WhatsApp episode might want to switch to Signal or Wire. [28], In the aftermath of the news, critics asserted that Apple's bug-bounty program, which rewards people for finding flaws in its software, might not have offered sufficient rewards to prevent exploits being sold on the black market, rather than being reported back to Apple. Pegasus is spyware that can be installed on devices running some versions of iOS, Apple's mobile operating system, as well on devices running Android. Pegasus is a modular malware that can initiate total surveillance on the targeted device, as per a report by digital security company Kaspersky.It installs the necessary modules to read the user’s messages and mail, listen to calls, send back the browser history and more, which basically means taking control of nearly all aspects of your digital life. Pegasus works by sending an exploit link, and if the target user clicks on the link, the malware or the code that allows the surveillance is installed on the user’s phone. It did not matter if the target did not take the call — the flaw allowed for the malware to be installed anyway. An investigation ensued with the collaboration of Lookout that revealed that if Mansoor had followed the link, it would have jailbroken his phone on the spot and implanted the spyware into it. Israel-based “Cyber Warfare” vendor NSO Group produces and sells a mobile phone spyware suite called Pegasus. In the specific cases of Apple and WhatsApp, therefore, neither company was aware of the security vulnerability, which was used to exploit the software and take over the device.). WhatsApp, which is owned by Facebook, is the world’s most popular messaging app, with more than 1.5 billion users worldwide. WhatsApp has an advantage over Telegram: in Telegram, only the “secret chats” are end-to-encrypted, while on WhatsApp everything is end-to-end encrypted by default. [7], The vulnerabilities were found ten days before the iOS 9.3.5 update was released. Details of the update were fixes for the three critical security vulnerabilities that Pegasus exploited. Traditionally, Pegasus works by sending a link, and if the target user clicks on it, it is installed on the user’s device. Called Pegasus, the malware appeared to originate from the Israeli spy technology company NSO Group. Mansoor sent the link to Citizen Lab. In the present case, WhatsApp has claimed that it sent a special message to approximately 1,400 users who it believed were impacted by the attack, to directly inform them about what had happened. Pegasus is the flagship spyware from Israel’s NSO Group It is believed to be known by other names like Trident and Q Suite WhatsApp is contacting users in … Pegasus works by sending an exploit link, and if the target user clicks on the link, the malware or the code that allows the surveillance is installed on the user’s phone. Pa Ranjith to bankroll Dhruv Vikram’s sports drama? The lawsuit puts new pressure on the company, the NSO Group, and on the government of Israel, which licenses the company’s sales to foreign governments of its spyware, known as Pegasus. Photo: Jack Guez/AFP/Getty Images An employee of NSO Group, an Israeli contractor known for its surveillance tools, is being charged for stealing the firm's internationally renowned "Pegasus" cell phone spyware and trying to sell it on the dark web for $50 million, according to the newspaper Globes . Even law enforcement agencies across the world want messages to be decrypted — a demand that WhatsApp is fighting, including in India. Pegasus is spyware that can be installed on devices running some versions of iOS, Apple's mobile operating system, as well on devices running Android. Pegasus Spyware Used in 45 Countries. Explained: What is Israeli spyware Pegasus, which carried out surveillance via WhatsApp? The malware, known as Pegasus (or Trident), was created by Israeli cyber-security firm NSO Group and has been around for at least three years --when it was first detailed in a … The malware, known as Pegasus (or Trident), was created by Israeli cyber-security firm NSO Group and has been around for at least three years — when it was first detailed in a report over the summer of 2016.. Citizen Lab has published a new report about the Pegasus spyware. [15] Two months after the murder and dismemberment of Washington Post journalist Jamal Khashoggi, a Saudi human rights activist, in the Saudi Arabian Consulate in Istanbul, Turkey, Saudi dissident Omar Abdulaziz, a Canadian resident, filed suit in Israel against NSO Group, accusing the firm of providing the Saudi government with the surveillance software to spy on him and his friends, including Khashoggi. Other key features of Pegasus, according to the brochure are: ability to access password-protected devices, being totally transparent to the target, leaving no trace on the device, consuming minimal battery, memory and data so as to not arouse suspicion in more alert users, a self-destruct mechanism in case of risk of exposure, and ability to retrieve any file for deeper analysis. “NSO continues to profit from its spyware being used to commit abuses against activists across the world and the Israeli government has stood by and watched it happen,” said Danna Ingleton, Deputy Director of Amnesty Tech. Khashoggi was slaughtered by Saudi agents at the kingdom’s consulate in Istanbul on October 2, 2018; Abdulaziz said he believed his phone was hacked in August that year. The brochure, called Pegasus: Product Description, says Pegasus can work on BlackBerry, Android, iOS (iPhone) and Symbian-based devices. Pegasus was used by hackers to infect devices with malware, disguised as incoming calls. [6], In late 2019, Facebook initiated a suit against NSO, claiming that WhatsApp had been used to hack a number of activists in India, leading to accusations that the Indian government was involved. WhatsApp uses the Signal app protocol for its end-to-end encryption, which seems safe so far. [5], It has been revealed that Pegasus can also target Android devices. A Trojan horse made of malware infected devices at Tel Aviv University's Cyber Week conference. Israeli Spyware Pegasus, developed by cyber-security company NSO, was used to snoop on around 1,400 WhatsApp users in 20 countries including Indian journalists and activists. However, it is important to be aware that unknown ‘zero-day’ exploits could exist for virtually every software and app in the world — and that they might be exploited at some point in the future by individuals or agencies determined to do so. He goes on to ask why Apple doesn't "spend its way out of security vulnerabilities? Pegasus and Trident: Executive four-minute read. Pegasus was found to be targeting a famous human rights activist named Ahmed Mansoor in the repressive United Arab Emirates. The messages had all led to websites that researchers say were set up as lures to infect visitors’ devices with Pegasus, ... Israel has export controls that ... used to silently install malware. In September 2018, The Citizen Lab, an interdisciplinary lab based at the Munk School of Global Affairs & Public Policy, University of Toronto, showed that Pegasus delivers “a chain of zero-day exploits to penetrate security features on the phone and installs Pegasus without the user’s knowledge or permission”. The very popularity of a messaging app makes it a target for hackers, cyber criminals, or other entities. [6], Apple released iOS version 9.3.5 for its line of iPhone smartphone products in August 2016. On Thursday, The Indian Express reported that the popular messaging platform WhatsApp was used to spy on journalists and human rights activists in India earlier this year. But while tools such as Pegasus can be used for mass surveillance; it would seem likely that only selected individuals would be targeted. "[29], It has been suggested that this article be, "An Israeli tech firm is selling spy software to dictators, betraying the country's ideals", "Government Hackers Caught Using Unprecedented iPhone Spy Tool", "With Israel's Encouragement, NSO Sold Spyware to UAE and Other Gulf States", "IPhone Users Urged to Update Software After Security Flaws Are Found", "Everything We Know About NSO Group: The Professional Spies Who Hacked iPhones With A Single Text", "Pegasus: The ultimate spyware for iOS and Android", "Apple Releases iOS 9.3.5 With Fix for Three Critical Vulnerabilities Exploited by Hacking Group", "Who are the hackers who cracked the iPhone? The operator can even turn on the phone’s camera and microphone to capture activity in the phone’s vicinity. Pegasus is a spyware developed by an Israeli cybersecurity firm that can allow someone to access files, photos and even call records of a smartphone. The Indian Express reported on Thursday that at least two dozen academics, lawyers, Dalit activists, and journalists were alerted by the company in India. Upon clicking on a malicious link, Pegasus secretly enables a jailbreak on the device and can read text messages, track calls, collect passwords, trace the phone location,[4] as well as gather information from apps including (but not limited to) iMessage, Gmail, Viber, Facebook, WhatsApp, Telegram, and Skype. [1] According to the Washington Post and other prominent media sources, Pegasus not only enables the keystroke monitoring of all communications from a phone (texts, emails, web searches) but it also enables phone call and location tracking, while also permitting NSO Group to hijack both the mobile phone's microphone and camera, thus turning it into a constant surveillance device. The company’s Pegasus software has been used to target journalists and activists across the globe – including in Morocco, Saudi Arabia, Mexico and the United Arab Emirates. About a quarter of those users — more than 400 million, or 40 crore — are in India, WhatsApp’s biggest market. To monitor a target, a government operator of Pegasus must convince the target to click on a specially crafted exploit link, which, when clicked, delivers a chain of zero-day exploits to penetrate security features on the phone and installs Pegasus without the user’s knowledge or permission. (A presumably newer version of the malware does not even require a target user to click a link. WhatsApp has not said how many people it contacted in India. [3], Pegasus is the name of a spyware that can be installed on devices running certain versions of iOS, Apple's mobile operating system. Arab human rights defender Ahmed Mansoor received a text message promising "secrets" about torture happening in prisons in the United Arab Emirates", along with a link which is a form of social engineering. Once Pegasus is installed, the attacker has complete access to the target user’s phone. Shruti DhapolaAssistant Editor at Indianexpress.com and looks after the Indian Expre... read more, * The moderation of comments is automated and not cleared manually by, Copyright © 2020 The Indian Express [P] Ltd. All Rights Reserved. Discovered in August 2016 after a failed attempt at installing it on an iPhone belonging to a human rights activist, an investigation revealed details about the spyware, its abilities, and the security vulnerabilities it exploited. CVE-2016-4657: Memory corruption in the Webkit – A vulnerability in the Safari WebKit that allows the attacker to compromise the device when the user clicks on a link. WhatsApp issued an urgent software update to fix the security bug that was allowing the spyware to exploit the app. ", "Meet Pegasus, the most-sophisticated spyware that hacks iPhones: How serious was it? The malware of concern, dubbed Pegasus, ... leaked emails included in lawsuits in Israel and Cyprus against NSO Group appeared to show the company had hacked the phone of … Apple released version 9.3.5 of its iOS software to fix the vulnerabilities. Technically, yes. The Pegasus tool at that time exploited a software chink in Apple’s iOS to take over the device. It has been used by as many as 40 intelligence agencies, many working for repressive regimes, to seize control of cell phones belonging to human rights activists, journalists, teachers, and victims of state violence. While removing a Pegasus infection cannot be successful without data loss, a user can take certain measures to prevent or at least reduce the impact of an infection by malware or spyware. WhatsApp sued the NSO Group in a federal court in San Francisco on Tuesday, accusing it of using WhatsApp servers in the United States and elsewhere “to send malware to approximately 1,400 mobile phones and devices (‘Target Devices’)… for the purpose of conducting surveillance of specific WhatsApp users (‘Target Users’)”. If it were a malware targeting a computer or a mobile phone, ... Israel, Brazil, Indonesia, Sweden, and the Netherlands. Punjab: ‘Soldier’ at farmers’ protest has agencies scurrying to ascertain his ‘true’ identity, Gold concealed in baggage trolley, customs arrests man, 5 years after return from Pakistan, Geeta’s hunt for home, parents continue, SC: Homeopathy practitioners can prescribe ‘immunity boosters’, can’t claim Covid cure, There should be fire in your hearts: MP minister urges for Bengal votes, Selling Air India, BJP woos minority in Kerala, next Republic Day chief guest, India diplomat to be next UN resident coordinator in Beijing, Kamal says alliance with Rajinikanth’s outfit possible, HC notice to Gujarat govt on Hardik’s plea to quash FIR, https://images.indianexpress.com/2020/08/1x1.png, here to join our channel (@indianexpress), Why Kerala local body election results are a victory for Pinarayi Vijayan, Why farmers continue to oppose Centre's proposal to end deadlock, Maharashtra House resolution on Arnab Goswami and its face-off with judiciary, How Punjab can achieve crop diversification, TMC's Suvendu Adhikari resigns as MLA; may join BJP during Amit Shah's Bengal visit, Farmers' stir: SC says govt talks haven't worked, proposes forming panel to end impasse, Vir Das Outside In The Lockdown Special review: A highly relatable Netflix special, Wonder Woman 1984 review round-up: Gal Gadot-starrer is an 'escapist superhero sequel', Watch: Cops dressed as Santa Claus and elf detain suspected drug dealer in Peru, NASA shares photo of what snow-covered Himalayas look like from space, India vs Australia 1st Test Playing 11: Saha, Shaw to play in Adelaide, Virat Kohli ahead of D/N Test: 'I am the representation of new India', Govt needs to ready solutions that will facilitate agrarian transition without hurting farmers, Remembering celebrated artistes who left us in 2020.