Budapest Post

Cum Deo pro Patria et Libertate
Budapest, Europe and world news

How to Search for, Spot and Stamp Out Pegasus Spyware From Your Phone

How to Search for, Spot and Stamp Out Pegasus Spyware From Your Phone

The powerful Israeli military-grade spyware made international headlines on Sunday, when media investigations discovered that at least 50,000 people across more than a dozen nations had their cellphones targeted in sophisticated hack attacks that stole information and turned devices into mobile bugs.

Governments, journalists, opposition politicians and rights groups worldwide are demanding a formal inquiry into Pegasus, the spyware product created by shadowy Israeli software company NSO Group. Sold to states to ‘fight terrorism and crime’, the software has been discovered to have been used in unscrupulous ways to target members of the press, lawmakers and others, helping to stamp out dissent or allow governments to get ahead of potentially embarrassing scandals.

How It Works


Pegasus is not your typical one-click piece of malware which requires user interaction – usually by following on a malicious link - to get access to a device. Instead, the spyware infects phones through a so-called zero-click attack, which needs no interaction from the user and simply installs itself and starts harvesting data.

Once installed, the spyware, which is compatible with both Android and Apple iOS, can gain access to all manner of data on a user’s phone, from contacts and encrypted messages to call records, photos, and GPS location data. What’s more, it’s capable of turning microphones and cameras on or off remotely, thus turning the user’s device into a mobile listening or viewing device.

To conceal its presence, Pegasus minimises bandwidth consumption to avoid draining the battery and raising user suspicions. Instead, it sends regular scheduled updates to command and control servers (C2s) – the computers or domains used by whoever is doing the spying. Unfortunately, the spyware is also impervious to commercially available antivirus software.

How to Check for Pegasus?


The spyware’s inconspicuous nature, its zero-click installation, and imperviousness to antiviruses makes it virtually impossible for phone owners to detect its presence simply by observing their device.

There’s hope, however. Because the software connects to the aforementioned C2s, a search to determine whether or not a phone communicated with known Pegasus installation servers can theoretically detect whether the malware is present.

Amnesty International, the London-based human rights organisation that helped media blow the lid off the extent of Pegasus’ spread in this weekend’s reporting, identified compromised iPhone devices by studying the records of process executions and network usage performed the phones’ database files - datausage.sqlite and netusage.sqlite.

Amnesty’s analysis found a total of 45 suspicious process names in their analysis, with Citizen Lab, a University of Toronto-based software developer working to protect citizens against surveillance, matching 28 of these processes in their own independently conducted inquiry.

Technology giants such as Apple, and app-makers such as Facebook’s WhatsApp, haven't simply been sitting on their hands while Pegasus runs amok on their devices and software since the spyware was first discovered in 2016, and have sought to close security breaches once they are found. This is one reason NSO Group has worked to develop new versions of its spyware. Unfortunately, the Israeli spyware giant appears to have remained one step ahead of companies such as Apple for the moment, with Citizen Lab research fellow Bill Marczak reporting on Monday that the latest version of iOS, version 14.6, is still vulnerable to Pegasus’ zero-click attacks.


Users can independently scan their phones for signs that their device has been compromised using Amnesty’s ‘indicator of compromise’ (IoC) toolkit. The software, formally known as the ‘Mobile Verification Toolkit’ or MVT, works with both iOS and Android, and is available for download here.

In its current form, the software is not an easy-to-use experience, has no graphical user interface, and installs on phones’ command line, meaning that basic knowledge of basic coding is needed (details here). The toolkit also requires the download and installation of dependencies to operate.

Once installed, the software allows users to create a backup of their device, check backup files, including artefacts from iTunes’ proprietary backup system, if applicable, extract artefacts from filesystem dumps, and compare stored data with known indicators of compromise. The Android version of the software, which Amnesty says is less fleshed out because of Pegasus’ greater prevalence on iOS devices, includes the ability to check for the download of non-safelisted APKs (apps), and to search for backups for text messages with links to the roughly 700 known NSO domains (Amnesty says this list will be continually updated).

TechCrunch contributor Zack Whittaker tested out the toolkit on an iPhone, and reported that it takes about 10 minutes to get it up and running, plus the time it takes to back up the phone, which is necessary to decrypt locally stored files. The scan itself takes just one to two minutes, and lists possible signs of compromise in the outputted files.

You’ve Got Pegasus – What Now?


Tech experts don’t make it explicitly clear what can be done if Pegasus is found on a device. In a 2019 study, Citizen Lab found that in the case of Android devices, the malware can survive a factory reset on some phones, meaning that the only way to be sure you’re not infected is to get a new phone.

It’s not clear whether NSO Group’s software can survive a hard reset on iOS devices, with Apple tech support reluctant even to admit that its advanced “sandboxed iOS architecture” can be compromised, and recommending software updates to deal with the problem (they don't).

Tech specialists don’t mention it, but another possible way to reduce exposure to Pegasus is to reduce one’s exposure to the digital world.

Journalists, activists, politicians and others who feel vulnerable can do so by using landlines or simple button phones with no internet capabilities for Pegasus to exploit, by engaging in face-to-face meetings instead of voice and text message conversations, using analogue or simple digital voice recorders, etc. If giving up your smartphone is not an option, there’s always the alternative of using a non-Android, non-iOS smartphone, which may be less vulnerable to the Israeli spyware by virtue of its more limited user base.

None of these techniques can guarantee that whoever may be monitoring you illegally won’t be able to do so, but it will at least require a greater effort on their behalf to do so.

AI Disclaimer: An advanced artificial intelligence (AI) system generated the content of this page on its own. This innovative technology conducts extensive research from a variety of reliable sources, performs rigorous fact-checking and verification, cleans up and balances biased or manipulated content, and presents a minimal factual summary that is just enough yet essential for you to function as an informed and educated citizen. Please keep in mind, however, that this system is an evolving technology, and as a result, the article may contain accidental inaccuracies or errors. We urge you to help us improve our site by reporting any inaccuracies you find using the "Contact Us" link at the bottom of this page. Your helpful feedback helps us improve our system and deliver more precise content. When you find an article of interest here, please look for the full and extensive coverage of this topic in traditional news sources, as they are written by professional journalists that we try to support, not replace. We appreciate your understanding and assistance.
Newsletter

Related Articles

0:00
0:00
Close
Satirical Sketch Sparks Political Spouse Feud in South Korea
Indonesia Quarry Collapse Leaves Multiple Dead and Missing
South Korean Election Video Pulled Amid Misogyny Outcry
Asian Economies Shift Away from US Dollar Amid Trade Tensions
Netflix Investigates Allegations of On-Set Mistreatment in K-Drama Production
US Defence Chief Reaffirms Strong Ties with Singapore Amid Regional Tensions
Vietnam Faces Strategic Dilemma Over China's Mekong River Projects
Malaysia's First AI Preacher Sparks Debate on Islamic Principles
Meta and Anduril Collaborate on AI-Driven Military Augmented Reality Systems
Russia's Fossil Fuel Revenues Approach €900 Billion Since Ukraine Invasion
Alcohol Industry Faces Increased Scrutiny Amid Health Concerns
U.S. Goods Imports Plunge Nearly 20% Amid Tariff Disruptions
Italy Faces Population Decline Amid Youth Emigration
Trump Accuses China of Violating Trade Agreement
OpenAI Faces Competition from Cheaper AI Rivals
Foreign Tax Provision in U.S. Budget Bill Alarms Investors
Russia Accuses Serbia of Supplying Arms to Ukraine
Gerry Adams Wins Libel Case Against BBC
EU Central Bank Pushes to Replace US Dollar with Euro as World’s Main Currency
U.S. Health Secretary Ends Select COVID-19 Vaccine Recommendations
Trump Warns Putin Is 'Playing with Fire' Amid Escalating Ukraine Conflict
India and Pakistan Engage Trump-Linked Lobbyists to Influence U.S. Policy
U.S. Halts New Student Visa Interviews Amid Enhanced Security Measures
Trump Administration Cancels $100 Million in Federal Contracts with Harvard
SpaceX Starship Test Flight Ends in Failure, Mars Mission Timeline Uncertain
King Charles Affirms Canadian Sovereignty Amid U.S. Statehood Pressure
EU Majority Demands Hungary Reverse Anti-LGBTQ+ Laws
Top Hotel Picks for 2025 Stays in Budapest Revealed
Iron Maiden Unveils 2025 Tour Setlist in Budapest
Chinese Film Week Opens in Budapest to Promote Cultural Exchange
Budapest Airport Launches Direct Flights to Shymkent
Von der Leyen Denies Urging EU Officials to Skip Budapest Pride
Alcaraz and Sinner Advance with Convincing Wins at Roland Garros
EU Ministers Lack Consensus on Sanctioning Hungary Over Rule of Law
EU Nations Urge Action Against Hungary's Pride Parade Ban
Putin's Helicopter Reportedly Targeted by Ukrainian Drones
U.S. Considers Withdrawing Troops from Europe
Russia Deploys Motorbike Squads in Ukraine Conflict
Critics Accuse European Court of Human Rights of Overreach
Spain Proposes 100% Tax on Non-EU Holiday Home Purchases
German Intelligence Labels AfD as Far-Right Extremist
Geert Wilders Threatens Dutch Coalition Over Migration Policy
Hungary Faces Multiple Challenges Amid EU Tensions and Political Shifts
Denmark Increases Retirement Age to 70, Setting a European Precedent
Any trade deal with US must be based on respect not threats', says EU commissioner
UK Leads in Remote Work Adoption, Averaging 1.8 Days a Week
Thirteen Killed in Russian Attacks Across Ukraine
High-Profile Incidents and Political Developments Dominate Global News
Netanyahu Accuses Western Leaders of 'Emboldening Hamas'
Ukraine and Russia Conduct Largest Prisoner Exchange of the War
×