extratone
commented
3 years ago "A serious attack on the iPhone was just seen in use for the first time"
'Aug 25, 2016 at 13:23'
/cdn.vox-cdn.com/uploads/chorus_image/image/50526131/cracked-iphone-stock-1196.0.0.jpg)
Earlier this month, an Emirati human rights activist named Ahmed Mansoor got a suspicious text. It promised new details of torture in the country’s state prisons, along with a link to follow if he was interested. If Mansoor had followed the link, it would have jailbroken his phone on the spot and implanted it with malware, capable of logging encrypted messages, activating the microphone and secretly tracking its movements.
The attack is detailed in a new report from Citizen Lab and Lookout Security, which received the link directly from Mansoor. The malware targets three previously undisclosed vulnerabilities in iOS, allowing for arbitrary code execution, access to kernel memory, and access to kernel privileges. When combined, those vulnerabilities allow for a remote jailbreak of an iOS device, a long sought-after capability that has never been previously observed in an active campaign.
On discovering the vulnerabilities, Citizen Lab and Lookout reported them to Apple, and fixes for the vulnerabilities have been patched with today’s release of iOS 9.3.5.
Citizen Lab linked the attack to a private Israeli spyware company known as NSO group, although it’s unclear how the exploits were first discovered. Earlier this year, the exploit broker Zerodium offered and awarded a million-dollar bounty for remote jailbreaking capability in iOS 9, which Citizen Lab notes is similar to the exploit used against Mansoor.
Apple recently launched its own bug bounty to encourage disclosure of such vulnerabilities. The highest bounty, up to $200,000, was offered for vulnerabilities that compromise the secure boot firmware.
The attack is likely to reignite the debate over private sector malware companies, which have drawn harsh criticism for selling intrusion software to oppressive regimes in Uganda, Ethiopia, and Bahrain.
How to fake a fingerprint and break into a phone
-"A serious attack on the iPhone was just seen in use for the first time"
/cdn.vox-cdn.com/uploads/chorus_image/image/69614140/acastro_190204_1777_privacy_0002.0.jpg)
Illustration by Alex Castro / The Verge
"Pegasus (spyware) - Wikipedia"
By ** ''
This article documents a current event. Information may change rapidly as the event progresses, and initial news reports may be unreliable. The latest updates to this article may not reflect the most current information. Please feel free to improve this article (but note that updates without valid and reliable references will be removed) or discuss changes on the talk page. _(July 2021)__ (Learn how and when to remove this template message)_
Pegasus
NSO Group, the Israeli technology firm that created the spyware
Developer(s) NSO Group
Operating system iOS, Android
Website https://nsogroup.com
Pegasus is spyware developed by the Israeli cyberarms firm NSO Group that can be covertly installed on mobile phones (and other devices) running most[1] versions of iOS and Android.[2] The 2021 Project Pegasus revelations suggest that current Pegasus software is able to exploit all recent iOS versions up to iOS 14.6.[1] According to the Washington Post and other prominent media sources, Pegasus not only enables the keystroke monitoring of all communications from a phone (texts, emails, web searches) but it also enables phone call and location tracking, while also permitting NSO Group to hijack both the mobile phone's microphone and camera, thus turning it into a constant surveillance device.[3]
The company had previously been owned by American private equity firm Francisco Partners,[4] then bought back by the founders in 2019.[5] NSO states that it provides "authorized governments with technology that helps them combat terror and crime",[6][7] has published sections of contracts requiring customers only to use its products for criminal and national security investigations, and stated that it has an industry-leading approach to human rights.[8] The spyware is named after the mythical winged horse Pegasus—it is a Trojan horse that can be sent "flying through the air" to infect phones.[9]
Pegasus was discovered in August 2018 after a failed attempt at installing it on an iPhone belonging to a human rights activist led to an investigation revealing details about the spyware, its abilities, and the security vulnerabilities it exploited. As of 2016, Pegasus was capable of reading text messages, tracking calls, collecting passwords, tracking location, accessing the target device's microphone and camera,[3] and harvesting information from apps. News of the spyware caused significant media coverage. It was called the "most sophisticated" smartphone attack ever, and was the first time that a malicious remote exploit using jailbreak to gain unrestricted access to an iPhone had been detected.[6]
On August 23, 2020, according to intelligence obtained by the Israeli newspaper Haaretz, the NSO Group was reported to have sold Pegasus spyware software for hundreds of millions of US dollars to the United Arab Emirates and other Gulf States, for surveillance of anti-regime activists, journalists and political leaders from rival nations, with Israeli government encouragement and mediation.[10] Later, on December 2020, Al Jazeera investigation show The Tip of the Iceberg, Spy partners, showed exclusive footage about Pegasus and its penetration into the phones of media professionals and activists, used by Israel to eavesdrop on its opponents and even its allies.[11][12]
In July 2021, widespread media coverage part of the Project Pegasus revelations along with an in-depth analysis by human rights group Amnesty International uncovered that Pegasus was still being widely exploited against high-profile targets. It showed that Pegasus was able to infect all modern iOS versions up to the latest release, iOS 14.6, through a zero-click iMessage exploit[1].
Contents
Discovery
Pegasus' iOS exploitation was identified in August 2016. Arab human rights defender Ahmed Mansoor received a text message promising "secrets" about torture happening in prisons in the United Arab Emirates by following a link. Mansoor sent the link to Citizen Lab, who investigated, with the collaboration of Lookout, finding that if Mansoor had followed the link it would have jailbroken his phone and implanted the spyware into it, in a form of social engineering.[13] Citizen Lab linked the attack to the NSO Group.
Regarding how widespread the issue was, Lookout explained in a blog post: "We believe that this spyware has been in the wild for a significant amount of time based on some of the indicators within the code" and pointed out that the code shows signs of a "kernel mapping table that has values all the way back to iOS 7" (released 2013).[14] _The New York Times and The Times of Israel_ both reported that it appeared that the United Arab Emirates was using this spyware as early as 2013.[15][16][17]
Several lawsuits outstanding in 2018 claimed that NSO Group helped clients operate the software and therefore participated in numerous violations of human rights initiated by its clients.[17] Two months after the murder and dismemberment of _Washington Post_ journalist Jamal Khashoggi, a Saudi human rights activist, in the Saudi Arabian Consulate in Istanbul, Turkey, Saudi dissident Omar Abdulaziz, a Canadian resident, filed suit in Israel against NSO Group, accusing the firm of providing the Saudi government with the surveillance software to spy on him and his friends, including Khashoggi.[3]
Spyware details
The spyware can be installed on devices running certain versions of iOS, Apple's mobile operating system, as well as some Android devices.[1] Rather than being a specific exploit, Pegasus is a suite of exploits which uses many vulnerabilities in the system. Infection vectors include clicking links, the Photos app, the Apple Music app, and iMessage. Some of the exploits Pegasus uses are zero-click—that is, they can run without any interaction from the victim. Once installed, Pegasus has been reported to be able to run arbitrary code, extract contacts, call logs, messages, photos, web browsing history, settings,[18] as well as gather information from apps including but not limited to communications apps iMessage, Gmail, Viber, Facebook, WhatsApp, Telegram, and Skype.[19]
At the 2017 Security Analyst Summit held by Kaspersky Lab, researchers revealed that Pegasus was available for Android in addition to iOS; Google refers to the Android version as Chrysaor, the brother of the winged horse Pegasus. Its functionality is similar to the iOS version, but the mode of attack is different. The Android version tries to gain root access (similar to jailbreaking in iOS); if it fails, it asks the user for permissions that enable it to harvest at least some data. At the time Google said that only a few Android devices had been infected.[20]
Pegasus hides itself as far as is possible and self-destructs in an attempt to eliminate evidence if unable to communicate with its command-and-control server for over 60 days, or if on the wrong device. Pegasus can also do this on command.[20]
Pegasus Anonymizing Transmission Network
Human rights group Amnesty International reported in the 2021 Project Pegasus revelations that Pegasus employs a sophisticated command-and-control (C&C) infrastructure to deliver exploit payloads and send commands to Pegasus targets. There are at least four known iterations of the C&C infranstructure, dubbed the Pegasus Anonymizing Transmission Network (PATN) by NSO group, each encompassing up to 500 domain names, DNS servers, and other network infrastructure. The PATN reportedly utilizes techniques such as registering high port numbers for their online infrastructure as to avoid conventional Internet scanning. PATN also uses up to three randomised subdomains unique per exploit attempt as well as randomised URL paths.[1]
Misuse
Although Pegasus is stated as intended to be used against criminals and terrorists,[8] use by authoritarian governments to spy on critics and opponents has often been reported.
Scandal in India
In late 2019, Facebook initiated a suit against NSO, claiming that Pegasus had been used to intercept the WhatsApp communications of a number of activists, journalists, and bureaucrats in India, leading to accusations that the Indian government was involved.[21][22][23]
Phone numbers of Indian ministers, opposition leaders and journalists were found on a database of NSO hacking targets by Project Pegasus in 2021.[24][25][26]
Use by Mexican drug cartels
Reversing the intended use against criminals, Pegasus has been used to target and intimidate Mexican journalists by drug cartels and cartel-entwined government actors.[27][28]
Assassination of Jamal Khashoggi
Main article: Assassination of Jamal Khashoggi
Pegasus software, whose sales are licensed by the Government of Israel to foreign governments, helped Saudi Arabia to spy on a Saudi dissident's smartphone and track his communication with journalist Jamal Kashoggi, who was assassinated in 2018.[29]
Project Pegasus revelations
Main article: Project Pegasus revelations
A leak of a list of over 50,000 phone number believed to have been identified as those of people of interest by clients of NSO since 2016 became available to Paris-based media nonprofit organisation Forbidden Stories and Amnesty International. They shared the information with seventeen news media organisations in what has been called "Project Pegasus", and a months-long investigation was carried out, which reported from mid-July 2021. The Pegasus Project involved 80 journalists from the media partners: The Guardian (UK), Le Monde (France), Die Zeit (Germany), The Washington Post (USA), Haaretz/TheMarker (Israel), Süddeutsche Zeitung, Aristegui Noticias, Radio France, Proceso, OCCRP, Knack, Le Soir, The Wire, Daraj,[30] Direkt36 (Hungary),[31] and PBS Frontline.[32] Evidence was found that many phones with numbers in the list had been targets of Pegasus spyware.[8]
Vulnerabilities
Lookout provided details of the three iOS vulnerabilities:[14]
As of July 2021, Pegasus likely uses many exploits, some not listed in the above CVEs.[1]
Reactions
News
News of the spyware received significant media attention,[18][34][35][36][37] particularly for being called the "most sophisticated" smartphone attack ever,[38][39] and, for being the first detection of a remote Apple jailbreak exploit.[40]
NSO Group comment
Dan Tynant of _The Guardian_ wrote an article that featured comments from NSO Group, where they stated that they provide "authorized governments with technology that helps them combat terror and crime", although the Group told him that they had no knowledge of any incidents.[41]
Bug-bounty program skepticism
In the aftermath of the news, critics asserted that Apple's bug-bounty program, which rewards people for finding flaws in its software, might not have offered sufficient rewards to prevent exploits being sold on the black market, rather than being reported back to Apple. Russell Brandom of _The Verge_ commented that Apple's bug-bounty program, which rewards people who manage to find faults in its software, maxes out at payments of $200,000, "just a fraction of the millions that are regularly spent for iOS exploits on the black market". He goes on to ask why Apple doesn't "spend its way out of security vulnerabilities?", but also writes that "as soon as [the Pegasus] vulnerabilities were reported, Apple patched them—but there are plenty of other bugs left. While spyware companies see an exploit purchase as a one-time payout for years of access, Apple’s bounty has to be paid out every time a new vulnerability pops up." Brandom also wrote; "The same researchers participating in Apple’s bug bounty could make more money selling the same finds to an exploit broker." He concluded the article by writing; "It's hard to say how much damage might have been caused if Mansoor had clicked on the spyware link... The hope is that, when the next researcher finds the next bug, that thought matters more than the money."[42]
See also
References
hide
Hacking in the 2010s
← 2000s Timeline 2020s →
Major incidents
2010
2011
2012
2013
2014
2015
2016
2017
2018
2019
Groups
Hacktivism
Advanced Persistent Threat
Individuals
Major vulnerabilities
publicly disclosed
Malware
2010
2011
2012
2013
2014
2015
2016
2017
2019
-"Pegasus (spyware) - Wikipedia"