What is Pegasus? Cyber ​​security expert explains how spyware invades phones and what it does when it enters

End-to-end encryption is a technology that scrambles messages on your phone and decrypts them only on the recipients’ phones, meaning anyone who intercepts messages in between can’t read them. Dropbox, Facebook, Google, Microsoft, Twitter, and Yahoo are some of the companies whose apps and services use end-to-end encryption.

This type of encryption is good for protecting your privacy, but governments don’t like it because it makes it difficult for them to spy on people, whether it’s tracking down criminals and terrorists or, as some governments do. do, spy on dissidents, protesters and journalists. Enter an Israeli tech company, NSO Group.

The company’s flagship product is Pegasus, spyware that can sneak into a smartphone and access everything on it, including its camera and microphone. Pegasus is designed to infiltrate devices running Android, Blackberry, iOS and Symbian operating systems and turn them into surveillance devices. The company says it sells Pegasus only to governments and only for the purpose of tracking down criminals and terrorists.

How it works

Earlier versions of Pegasus were installed on smartphones through vulnerabilities in commonly used applications or through phishing, which involves tricking a targeted user into clicking a link or opening a document that secretly installs the software. It can also be installed on a wireless transceiver located near a target, or manually if an agent can steal the target’s phone.

As of 2019, Pegasus users can install the software on smartphones with a missed call on WhatsApp, and can even delete the missed call recording, preventing the phone owner from knowing something is wrong. Another way is to simply send a message to a user’s phone that doesn’t produce any notifications.

This means that the latest version of this spyware does not require any action from the smartphone user. All that is required for a successful spyware attack and installation is to have a particular vulnerable application or operating system installed on the device. This is called a clickless exploit.

Once installed, Pegasus can theoretically recover all data from the device and relay it back to the attacker. It can steal photos and videos, recordings, location records, communications, web searches, passwords, call logs, and social media posts. It also has the ability to activate cameras and microphones for real-time monitoring without the user’s permission or knowledge.

Who uses Pegasus and why

NSO Group says it is building Pegasus only for governments to use in counterterrorism and law enforcement work. The company markets it as a targeted spy tool to track down criminals and terrorists, not for mass surveillance. The company does not disclose its customers.

The first reported use of Pegasus was made by the Mexican government in 2011 to track down notorious drug lord Joaquín “El Chapo” Guzmán. The tool was also reportedly used to track people close to murdered Saudi journalist Jamal Khashoggi.

It is not known who or what types of people are targeted and why. However, much of the recent reporting on Pegasus focuses on a list of 50,000 phone numbers. The list has been attributed to NSO Group, but the origins of the list are unclear. An Amnesty International statement in Israel said that the list contains phone numbers that were marked as “of interest” to the various NSO customers, although it is not known whether any of the phones associated with the numbers were actually tracked.

A media consortium, the Pegasus Project, analyzed the phone numbers on the list and identified more than 1,000 people in more than 50 countries. The findings included people who appeared to be outside of the NSO Group’s restriction on investigating criminal and terrorist activity. These include politicians, government officials, journalists, human rights activists, business leaders and members of the Arab royal family.

Other ways to track your phone

Pegasus is breathtaking in his stealth and apparent ability to take full control of someone’s phone, but that’s not the only way to spy on people through their phones. Some of the ways that phones can help with surveillance and harm privacy include location tracking, eavesdropping, malware, and collecting data from sensors.

Governments and telephone companies can track a phone’s location by tracking cellular signals from cellular transceivers and cellular transceiver simulators like the StingRay device. Wi-Fi and Bluetooth signals can also be used to track phones. In some cases, applications and web browsers can determine the location of a phone.

Eavesdropping is more difficult to achieve than tracking, but it is possible in situations where encryption is weak or missing. Certain types of malware can compromise privacy when accessing data.

The National Security Agency sought deals with tech companies under which the companies would give the agency special access to their products through backdoors, and build backdoors on its own. Companies say backdoors defeats the purpose of end-to-end encryption.

The good news is, depending on who you are, you’re unlikely to be the target of a government wielding Pegasus. The bad news is that this fact alone does not guarantee your privacy.

[Understand new developments in science, health and technology, each week. Subscribe to The Conversation’s science newsletter.]