Apple sues Pegasus spyware developer: What you need to know

Angela Lang / CNET

It’s a nonsense of a digital spy case. Security researchers have revealed evidence of attempts or successful installations of Pegasus, software made by an Israeli-based cybersecurity firm NSO Group, on 37 phones belonging to activists, rights workers, journalists and business people. They appear to have been targets of covert surveillance software designed to help governments prosecute criminals and terrorists.

Now Apple has sued the NSO Group, which seeks to prevent the company’s software from being used on Apple devices, requires the NSO to locate and delete all private data that its app has collected, and disclose the profits from the operation. “Private companies developing state-sponsored spyware have become even more dangerous,” Apple chief software officer Craig Federighi said in a statement Tuesday.

Pegasus has been a politically explosive subject that has put Israel under pressure from activists and from governments concerned about the misuse of the software. France and the United States raised previous concerns, and The NSO has suspended some countries’ Pegasus privileges. Earlier in November, the US federal government took much stronger action, blocking sales of U.S. technology to NSO by putting the company on the Government’s Unity List.

The phones were on an activist organization’s list of more than 50,000 phone numbers for politicians, judges, lawyers, teachers and others. Also on the list is 10 prime ministers, three presidents and one king, according to a international study published in mid-July by The Washington Post and other media, although there is no evidence that being on the list means that an attack was attempted or successful.

Pegasus is the latest example of how vulnerable we all are to digital curiosity. Our phones store our most personal information, including pictures, text messages and emails. Spyware can directly detect what is going on in our lives by bypassing the encryption that protects data sent over the Internet.

The 50,000 phone numbers are connected to phones around the world, though NSO disputes the connection between the list and the actual phones that Pegasus is targeting. Units from dozens of people close to Mexican President Andrés Manuel López Obrador were on the list, as were those belonging to journalists at CNN, the Associated Press, The New York Times and The Wall Street Journal. Several phones on the list, including one belonging to Claude Mangin, the French wife of a political activist imprisoned in Morocco, were infected or attacked. Other cases of Pegasus infection have appeared since the first revelations.

Here’s what you need to know about Pegasus.

What is NSO Group?

It is a company that licenses surveillance software to public authorities. The company says its Pegasus software provides a valuable service because encryption technology has enabled criminals and terrorists to go.dark. “The software secretly runs on smartphones and sheds light on what their owners do. Other companies provide similar software.

CEO Shalev Hulio co-founded the company in 2010. NSO also offers other tools that locate where a phone is being used, defend itself against drones and mine law enforcement data to spot patterns.

NSO has been implicated by previous reports and lawsuits in other hacks, including one reported hack by Amazon founder Jeff Bezos in 2018. A Saudi dissident sued the company in 2018 for its alleged role in hacking a device belonging to journalist Jamal Khashoggi, who had been murdered inside the Saudi embassy in Turkey that year.

What is Pegasus?

Pegasus is NSO’s best known product. It can be installed remotely without a monitoring target ever having to open a document or website link, according to The Washington Post. Pegasus reveals everything to the NSO customers who control it – text messages, photos, emails, videos, contact lists – and can record phone calls. It can too secretly turn on a phone’s microphone and cameras to create new footage, The Washington Post said.

General security practices like updating your software and using two-factor authentication can help keep mainstream hackers at bay, but protection is really difficult when expert, well-funded attackers concentrate their resources on one person.

Pegasus should not be used to go after activists, journalists and politicians. “NSO Group licenses its products only to state intelligence and law enforcement agencies with the sole purpose of preventing and investigating terrorism and serious crime, “the company said on its website.” Our control process goes beyond legal and regulatory requirements to ensure the lawful use of our technology as designed. “

Human rights group However, Amnesty International documents in detail how it tracked compromised smartphones to the NSO Group. Borgerlab, a Canadian security organization at the University of Toronto, said it independently validated the conclusions of Amnesty International after examining your phone’s backup data.

In September, however, Apple fixed a security hole that Pegasus exploited for installation on iPhones. Malware often uses collections of such vulnerabilities to gain a foothold in a device and then extend privileges to become more powerful. NSO Group’s software also runs on Android phones.

Why is Pegasus in the news?

Forbidden Stories, a non-profit organization for journalism in Paris, and Amnesty International, a human rights group, shared with 17 news organizations a list of more than 50,000 phone numbers of people believed to be of interest to NSO customers.

The news sites confirmed the identities of many of the people on the list and infections on their phones. Of data from 67 phones on the list, 37 exhibited signs of Pegasus installation or attempted installation, according to The Washington Post. Of those 37 phones, 34 were Apple iPhones.

The list of 50,000 telephone numbers includes French President Emmanuel Macron, Iraqi President Barham Salih and South African President Cyril Ramaphosa. Also on it are seven former prime ministers and three current ones, Pakistan’s Imran Khan, Egypt’s Mostafa Madbouly and Morocco’s Saad-Eddine El Othmani. King Mohammed VI of Morocco is also on the list.

The episode has not helped Apple’s reputation when it comes to device security. “We take any attack on our users very seriously,” Federighi said. The company said it will donate $ 10 million and any damages from the lawsuit to organizations that advocate for privacy and pursue research in online surveillance. It’s a drop in the bucket too Apple, which reported a profit of 20.5 billion for its most recent quarter, but it may be important for much smaller organizations like Citizen Lab.

Whose Phones Infected Pegasus?

In addition to Mangin, two journalists at the Hungarian investigative site Direkt36 had infected phones, The Guardian reported.

ONE Pegasus attack was launched on the phone by Hanan Elatr, wife of the murdered Saudi columnist Jamal Khashoggi, told The Washington Post, though it was not clear if the attack was successful. But the spyware got into the phone of Khashoggi’s fiancé, Hatice Cengiz, shortly after his death.

Seven people in India was found with infected phones, including five journalists and an adviser to the opposition party, who is critical of Prime Minister Narendra Modi, The Washington Post reports.

And six people working for Palestinian human rights groups had Pegasus-infected phones, reported Citizen Lab in November,

What are the consequences of the Pegasus situation?

The United States cut off the NSO Group as a customer of U.S. products, a serious step, as the company needs computer processors, phones, and developer tools that often come from U.S. companies. NSO “supplied spyware to foreign governments” who used it maliciously to target officials, journalists, businessmen, activists, academics and embassy workers. These tools have also enabled foreign governments to carry out transnational repression, “the Ministry of Trade said.

Macron changed one of his cell phone numbers and requested new security checks, Politico reported. He convened a national security meeting to discuss the issue. Macron also raised Pegasus concerns with Israeli Prime Minister Naftali Bennett urging the country to investigate the NSO and Pegasus, The Guardian reported. The Israeli government must approve export licenses for Pegasus.

Israel set up an audit commission to look into Pegasus situation. And on July 28th Israeli defense authorities inspected NSO offices personally.

European Commission chief Ursula von der Leyen said that if the allegations are confirmed, that Use of Pegasus is “completely unacceptable.” She added: “Media freedom, free press is one of the core values ​​of the EU.”

Nationalist Congress Party of India required a study of Pegasus use.

Edward Snowden, who in 2013 leaked information about the US National Security Agency’s surveillance practices, called for a ban on the sale of spyware in an interview with The Guardian. He argued that such tools would otherwise soon be used to spy on millions of people. “When we talk about something like an iPhone, they all run the same software around the world. So if they find a way to hack one iPhone, they’ve found a way to hack them all,” Snowden said.

What does the NSO have to say about this?

NSO recognizes that its software may be misused. It cut off two customers in the past 12 months due to concerns about human rights violations, according to The Washington Post. “To date, the NSO has rejected over $ 300 million in sales opportunities as a result of its human rights reviews,” the company said in a statement. June transparency report.

However, the NSO strongly challenges any link to the list of telephone numbers. “There is no connection between the 50,000 numbers to NSO Group or Pegasus,” the company said in a statement.

“Any allegation of misuse of the system concerns me,” Hulio told the Post. “It violates the trust we place in our customers. We investigate every claim.”

In a statement, the NSO rejected “false allegations” about Pegasus, which it said were “based on misleading interpretation of leaked data.” Pegasus “can not be used to conduct cyber surveillance in the United States,” the company added.

The NSO will try to reverse the US government’s sanction. “We look forward to presenting the full information on how we have the world’s most stringent compliance and human rights programs based on the American values ​​we deeply share, which has already resulted in several interruptions of contacts with public authorities who abused our products, “an NSO spokesman said.

Earlier, the NSO had also blocked Saudi Arabia, Dubai in the United Arab Emirates and some Mexican government agencies from using the software, It writes the Washington Post.

How can I tell if my phone has been infected?

Amnesty International released an open source tool called MVT (Mobile Verification Toolkit) designed to detect traces of Pegasus. The software runs on a personal computer and analyzes data, including backup files exported from an iPhone or Android phone.