Excellent study material for all civil services aspirants - begin learning - Kar ke dikhayenge!
SHARE:
CONCEPT – PEGASUS WHATSAPP-SNOOPING SOFTWARE
Read more on - Polity | Economy | Schemes | S&T | Environment
- What it is: Pegasus malware is a special spyware that hacks any iOS or Android device to steal data from the infected device. Data can be text messages, emails, key logs, audio and information from installed applications, such as Facebook or WhatsApp. The spyware can record conversations and video as well as snap pictures from the device’s camera.
- Who created it: The malware was created by NSO Group, an Israeli cybersecurity firm founded in 2010, and has been around since 2016. Pegasus is used to stealthily gather information from high-value targets, including executives with strategic corporate information and government officials who have access to national or international secrets.
- How Pegasus works: A Pegasus attack starts with a simple phishing scheme - the attacker identifies a target then sends that target a website URL via email, social media, text message or any other message. In the case of iOS devices, once the user clicks on the link, the malware secretly carries out a trio of zero-day exploits against the victim’s device, jailbreaking it remotely so the spyware can be installed. The only indication that something has occurred is that the browser closes after the user clicks the link. There’s no other indication that anything has happened or that any new processes are running. Once Pegasus is installed, it begins contacting the operator’s command and control servers to receive and execute the operator’s commands.
- Structure: The spyware contains malicious code, processes and apps that spy on what the user does on the device, collects data and reports back what the user does. The malware can access and exfiltrate calls, emails, messages, and logs from applications including, Facebook, Facetime, Gmail, WhatsApp, Tango, Viber and Skype. Once the spyware jailbreaks the user’s device, it compromises the original apps already installed on the device to capture data rather than download malicious versions of these apps.
- Special: Pegasus for Android doesn’t require zero-day vulnerabilities to root the target device and install the malware. Rather, the malware uses a well-known rooting technique called Framaroot. With Pegasus for iOS, if the zero-day attack execution failed to jailbreak the device, the overall attack sequence failed. However, the hackers built functionality into the Android version that enables Pegasus to still ask for permissions so it can access and exfiltrate data if the initial attempt to root the device is unsuccessful.
- History of Pegasus: Pegasus was first discovered by Ahmed Mansoor, a human rights activist in the United Arab Emirates (UAE). On August 10 and 11, 2016, Mansoor, now imprisoned in the UAE, received SMS text messages on his iPhone that promised if he clicked on the link in the messages, he would receive new information about individuals tortured in UAE jails. Mansoor didn’t click on the link. Rather, he sent the messages to researchers at the Citizen Lab, an organization based at the University of Toronto. The researchers recognized that the links belonged to an exploit infrastructure connected to the NSO Group, which sells Pegasus and other spyware to governments known for human rights violations to spy on critics and activists.
- Apple and Google respond: When information about the iOS version of Pegasus was first released, Apple issued an iOS security update that patched the three vulnerabilities. Google helped researchers investigate the case with the Android version and notified potential Pegasus targets directly. Google claimed that just a few dozen Android devices had been infected. In 2018, an Amnesty International staff member received a suspicious WhatsApp message that included a link that, if clicked, would have installed Pegasus on the employee’s mobile device. WhatsApp ultimately patched the flaw that would have allowed an attacker to infect a victim’s device with the spyware.
- Who uses Pegasus? NSO Group has said it sells its surveillance software to governments to help them fight terrorism and serious crime. Its spyware, including Pegasus, has been licensed to dozens of countries, including Mexico, Bahrain, Saudi Arabia and the UAE.
- 2019 scandal: On October 30 2019, WhatsApp's parent company Facebook confirmed that Pegasus snooping software of Israel’s NSO Group was used to target Indian journalists, activists, lawyers and senior government officials. They are believed to have been targets of surveillance for a two-week period until May 2019, when the Indian national election was held. The snooping scandal was came out after WhatsApp had filed a case in California’s Northern District federal court against the NSO group alleging the NSO group had developed the software used to infect 1,400 “target devices” with malware.
- Govt. response : The Indian IT Ministry sought a detailed response from WhatsApp on the issue. They responded that they had alerted the government on two occasions - once in May 2019 and for the second time in September 2019. The CERT-IN responded by saying that the alerts weren't specifically worded to inform that Pegasus was being misused.
* Content sourced from free internet sources (publications, PIB site, international sites, etc.). Take your own subscriptions. Copyrights acknowledged.
COMMENTS