What is Pegasus Malware?
Pegasus is an advanced spyware developed by NSO Group, an Israeli cybersecurity company. It is designed to infiltrate smartphones, both iOS and Android, with the goal of extracting a wide range of sensitive data without the user’s knowledge. This includes text messages, call logs, emails, key logs, photos, videos, location data, and more. Pegasus is capable of secretly activating the camera and microphone of the device, allowing attackers to conduct real-time surveillance.
How Does Pegasus Malware Work?
Pegasus uses sophisticated techniques to gain access to and control the target device. Once installed, it communicates with command-and-control servers operated by attackers, which allows them to issue commands and extract data.
1. Phishing Attacks and Zero-Day Exploits
The most common way for Pegasus to be installed is through phishing schemes. The attacker sends the target a URL via email, social media, or text message. If the target clicks the link, the malware exploits vulnerabilities (known as zero-day exploits) in the operating system. These vulnerabilities allow the malware to be installed without the target’s knowledge. Once installed, the malware bypasses the phone’s security, including app permissions, and takes control of the device.
2. Zero-Click Attacks
Pegasus is particularly notorious for its ability to execute zero-click attacks. This means that the spyware can be installed on the device without the victim needing to click anything. It can be delivered through a missed call on WhatsApp, a vulnerable app, or even a malicious website that automatically exploits vulnerabilities in the device.
3. Jailbreaking (for iOS)
For iPhones, Pegasus often exploits vulnerabilities in iOS that allow the spyware to “jailbreak” the device. Jailbreaking removes the limitations imposed by Apple on its operating system, giving the malware deeper access to the device. This allows the spyware to bypass normal security features and collect data from the installed apps like WhatsApp, Gmail, Facebook, Instagram, and more.
4. Rooting (for Android)
For Android devices, Pegasus uses a technique called rooting. Rooting is the Android equivalent of jailbreaking, and it grants the malware access to a much deeper layer of the device’s functionality. Unlike iOS, rooting on Android devices often doesn’t require zero-day exploits but uses known techniques like the Framaroot tool.
Once installed, Pegasus can access virtually all of the information on the device and monitor the user’s activities in real-time.
What Data Can Pegasus Spyware Access?
Once installed, Pegasus can monitor and steal a variety of sensitive data, including but not limited to:
- Text Messages & Emails: Pegasus can capture all incoming and outgoing messages, even those sent via encrypted platforms like WhatsApp and Telegram.
- Call Logs: It can record and extract information about your calls, including the contact details and call duration.
- Photos & Videos: Pegasus can access and exfiltrate media stored on the device.
- Location Data: It can track the location of the device using GPS data.
- Real-Time Surveillance: Pegasus can turn on the camera and microphone without the user knowing, allowing attackers to spy on them in real time.
- Social Media Activity: The spyware can access and exfiltrate data from apps like Facebook, Instagram, and WhatsApp, including private messages, posts, and comments.
- Passwords & Credentials: It can record keystrokes and steal login credentials, which can be used for further attacks.
Who Uses Pegasus and Why?
NSO Group claims that it sells Pegasus exclusively to government agencies, such as law enforcement and intelligence agencies, with the intention of helping them combat terrorism and serious crime. However, in practice, Pegasus has been used extensively by authoritarian governments to spy on dissidents, human rights activists, journalists, and political opponents.
Countries like Mexico, Saudi Arabia, India, Bahrain, and the United Arab Emirates (UAE) have been linked to the use of Pegasus to monitor activists, journalists, and politicians. Notably, Saudi journalist Jamal Khashoggi was reportedly targeted by Pegasus before his assassination in 2018.
History of Pegasus Malware
The first known instance of Pegasus was reported in 2016 when Ahmed Mansoor, a human rights activist in the UAE, received suspicious text messages containing a link to a website that promised information about torture in UAE prisons. Mansoor, however, did not click the link but forwarded it to researchers at Citizen Lab, a cybersecurity research group. This led to the discovery of the spyware and its connection to NSO Group.
Since then, Pegasus has been used in numerous high-profile attacks. In 2018, Amnesty International staffers were targeted by a similar phishing attack. Various investigations, including the Pegasus Project, have uncovered that the spyware has been used to target over 50,000 phone numbers of politicians, journalists, and human rights defenders.
Signs That Your Phone May Have Pegasus
Pegasus is designed to be stealthy, and as a result, detecting it can be difficult. However, there are a few indicators that may suggest that your phone has been compromised:
- Battery Drain: If your phone is experiencing rapid battery drain, it could indicate that spyware is running in the background.
- Overheating: A sudden increase in phone temperature could mean that Pegasus is actively monitoring the device.
- Unexplained Data Usage: Significant data consumption could suggest that Pegasus is transmitting your personal data to a remote server.
- Strange Behavior: Your phone might behave oddly, such as apps crashing or the camera turning on without you initiating it.
How to Detect Pegasus Malware on Your Phone
Detection of Pegasus malware requires specialized tools and expertise. Amnesty International has developed the Mobile Verification Toolkit (MVT), which allows users to scan their phones for traces of Pegasus infection. Here’s a brief guide on how to detect Pegasus:
For iOS (iPhone):
- Backup Your Data: Ensure that you back up your encrypted data to another device or cloud storage.
- Use MVT: Download and follow the instructions from Amnesty International’s Mobile Verification Toolkit.
- Update iOS: Regularly update your iOS system to ensure that security vulnerabilities are patched.
For Android:
- Check for Malicious Texts and APKs: Look for any suspicious text messages or apps installed from third-party sources.
- Use MVT: You can still use MVT for Android, although it is primarily designed for iOS. Look for unusual behavior or unauthorized apps.
- Rooting/Framaroot: Check for signs of rooting, as Pegasus for Android may attempt to use tools like Framaroot.
How to Remove Pegasus from Your Device
If you suspect that your phone has been infected with Pegasus, the following steps may help mitigate the threat:
- Restart Your Device: This might stop the spyware temporarily.
- Reset to Factory Settings: A factory reset can remove most malware, but it will also erase all your data.
- Update Your Software: Make sure your device’s operating system is up-to-date with the latest security patches.
- Consult Cybersecurity Experts: If you are unable to remove Pegasus on your own, consider consulting a professional cybersecurity service.
How to Protect Your Device from Pegasus
Protecting yourself from Pegasus and similar spyware requires adopting best practices for mobile security:
- Install Security Updates: Regularly update your device’s operating system to ensure known vulnerabilities are patched.
- Avoid Suspicious Links: Be cautious about clicking links in unsolicited emails or messages.
- Use Encrypted Messaging: Use encrypted communication apps such as Signal or WhatsApp for secure messaging.
- Implement Strong Authentication: Use two-factor authentication on your accounts to add an extra layer of security.
- Monitor Device Behavior: Keep an eye on unusual device behavior, including battery drain, overheating, and data usage.
Conclusion
Pegasus is one of the most dangerous and sophisticated pieces of spyware ever developed. Its ability to secretly monitor and exfiltrate data from smartphones without the user’s knowledge makes it a serious threat to privacy and security. If you believe you may be a target of surveillance, it’s crucial to stay vigilant, use the appropriate detection tools, and take steps to protect your data. While removing Pegasus from your device can be challenging, working with cybersecurity professionals and utilizing tools like Amnesty International’s Mobile Verification Toolkit can help mitigate the threat.
lookout-pegasus-technical-analysis PDF DOWNLOAD
