Pegasus spyware: what to know about this surveillance tool

Pegasus spyware made its infamous debut in 2016 and occupied headlines as a controversial digital spying tool. In 2021, we are all reminded of its ominous potential.

A recent investigation has exposed overwhelming evidence depicting the massive alleged global influence of Pegasus spyware. According to it, Pegasus might violate the privacy of journalists, activists, politicians, and other high-profile figures. Let’s find out the true story behind Pegasus spyware, a tool allegedly used for repression and other human rights violations.

Main facts about Pegasus spyware

Pegasus spyware is a tool developed by an Israeli company called NSO Group. According to its official documentation, the solution assists governments and law enforcement agencies in fighting for justice. Thus, the original purpose of Pegasus is to aid these institutions in criminal investigations.

Here are some of the obstacles that Pegasus creators claim to address and resolve:

• Encryption. Robust encryption protocols and tools help all members of digital society perform their tasks covertly.
• Identity masking. Many netizens employ various techniques to make their digital presence as private and anonymous as possible.
• Frequent SIM card change. People might regularly replace SIM cards to prevent various types of interceptions.
• Data extraction. Some crucial information remains only on the end-users devices as it does not travel over a network.

Thus, NSO Group paints a picture of a cutting-edge tool essential in combating modern-day issues. However, the narrative of a justice-seeking solution is not entirely accurate.

Essentially, Pegasus spyware helps governments spy on citizens. And since its use appears to be untraceable, victims cannot associate the software with the government using it. However, this does not sit well with civil liberties groups and activists. Many label Pegasus as a spyware-for-hire business, with little to no control over how the tool serves its clients.

Pegasus spyware can fly, track, intercept and decrypt

According to its creators, here is what Pegasus spyware is capable of:

• Limitless control of targets’ devices. The operators of Pegasus can secretly collect various information from people’s smartphones. This data includes their location, photos, videos, relationships, schedules, activities, etc.
• Reverse encrypted information. Pegasus can overcome encryption, SSL, and proprietary protocols.
• Surveillance of specific applications. The tool can monitor applications like Facebook, Viber, WhatsApp, and Skype.
• Exact location. Pegasus reads GPS coordinates to track targets and get their whereabouts around the clock.
• Call interception. Pegasus spyware can monitor voice and VoIP calls in real-time.
• Evading identity masking. The tool accurately monitors targets despite SIM card replacement or another virtual spoofing.

How does Pegasus infect devices?

Similar to its stealthy operation once active, Pegasus spyware takes a similarly covert technique to infect targets. As reported, it typically exploits zero-day flaws that both users and software developers are not aware of. Forbes also highlighted the transformation of Pegasus distribution:

• Initially, the spyware reached devices via messages sent to the targets’ smartphones. The receivers had to click on the links within these texts to let Pegasus inside.
• Now, Pegasus has evolved and does not require users to click on any links physically. According to ThreatPost, NSO Group potentially chose zero-click techniques to leave even less notable attack traces. Additionally, it is not just text messages that could help Pegasus spyware arrive. Even unanswered phone calls could open doors for Pegasus to enter.

How can such a tool exist?

Undeniably, Pegasus spyware is a robust cyber intelligence tool. Its capabilities are beyond belief, and it can redefine the traditional surveillance standards.

However, how can such a powerful tool exist and be available for purchase?

NSO Group promotes its product exclusively for law enforcement agencies and government institutions. The goal is to help fight crime and, likely, some cases greatly benefit from this asset.

Sadly, Pegasus spyware is an ideal solution for oppressive regimes to actively silence and track targets. The inappropriate, unethical, and unjust usage of Pegasus is a staggering threat. Therefore, stories of Pegasus helping surveil journalists, activists, and politicians are quick to trigger profound reactions.

The list of Pegasus alleged targets

Recently, Amnesty International and Forbidden Stories published a ground-breaking story involving Pegasus. Allegedly, the tool might have helped monitor more than criminals and terrorists. Such assumptions emerged after a list containing more than 50,000 supposed Pegasus spyware targets leaked. Of course, at this time, there is no tangible evidence claiming any of these phone numbers as infected.

The collection included journalists, human rights activists, and heads of state. Thus, if true, this would mean that Pegasus fuels a massive and global surveillance campaign.

Amnesty International also ran an in-depth forensic analysis of mobile devices belonging to prominent human rights defenders and journalists. According to the results, 37 out of 67 devices tested positive for Pegasus spyware. Therefore, it could be that this tool does have a role in more shady global operations.

The NSO Group commented on the situation as well, denying the accusations put upon it. The company claims that it would never tolerate such use of Pegasus spyware. According to them, surveillance of journalists, human rights activists, and civil organizations is off-limits. Thus, attempts to perform such privacy invasions would force NSO Group to drop such clients.

However, with the unknown origin of the list, it is difficult to make the final ruling on this situation. Like the forensic analysis, some evidence suggests that Pegasus spyware might be doing more than proclaimed officially.

Thus, Pegasus spyware could be a menace leading to a global privacy disaster. It is also not the first time NSO Group had to answer some serious accusations.

The Washington Post also reported how the tool allegedly hacked a smartphone belonging to the wife of an imprisoned activist. In 2019, WhatsApp sued the company for Pegasus spyware supposedly hacking around 1,400 devices. In 2020, the FBI investigated NSO for alleged connection to the hacking of Jeff Bezos’s phone.

But for now, there seems to be a lot of guessing and finger-pointing.

Should users worry?

If the thought of Pegasus spyware terrifies you, there are several tips you should follow to become safer. While Pegasus’s capabilities make it immune to most of these precautions, they will help defend against less sophisticated threats.

• Check your phone for Pegasus spyware. Amnesty has released a tool that helps scan your device for traces of Pegasus. See official instructions for more information and guidelines.
• Install all available updates and patches as soon as possible. Outdated software simplifies malware distribution. Thus, ensure that apps and OS run the latest versions.
• Use strong and unique passwords. Set different passwords for each account you control. Additionally, come up with lengthy combinations containing letters, special symbols, and numbers.
• Do not click on random links. Be aware of smishing strategies that might contribute to the distribution of Pegasus or similar spyware.
• Turn on encryption. You can encrypt files or access to apps on your smartphone. This change could prevent unauthorized access to your device’s assets. Additionally, employ a VPN to prevent digital entities from monitoring your location and activities online. Of course, it is not a foolproof method, but it will keep your identity and information safer.