Pegasus Spyware

Pegasus Spyware

Context:

• According to reports of the Washington Post and Amnesty International -Pegasus spyware targeted journalists in India.
• The journalists include Siddharth Varadarajan of The Wire and also Anand Mangnale who is South Asia’s editor of the Organised Crime and Corruption Report Project (OCCRP).
• The intrusion came into limelight in October 2023 when Apple warned its users, including MPs who were more vulnerable to ‘state­sponsored attacks’ on their iPhones.

More about the news:

• When Apple issued a security notification to certain iPhone users (which include MPs), in the month of October, researchers at Amnesty International’s Security Lab analysed the suspected infected devices.
• These suspected devices also include those which belonging to Mr. Varadarajan and Mr. Mangnale.
• At the end of their analysis, they came to the result that there are traces of Pegasus’s activity on their respective devices.
• They also concluded that a message which meant to facilitate a “zero­click exploit” had been sent to the respective phones.
• When the message was delivered, it was designed to covertly install Pegasus on the targeted device.

About Pegasus:

• Pegasus is a type of malware which is known as spyware.
• It is called as Spyware because it is used to mainly spy on the targeted device.
• Once it is installed on the targeted device it can steal private data.
• It is well-known worldwide due to the sophisticated and dangerous technology.
• This spyware was created by an Israeli spy-tech company which is called as NSO Group.
• The NSO group claims that the proprietary spyware has been and will be sold to only legitimate governments around the world.
• The group also said that it is sold only for the supposed purpose of protecting national security and preventing terrorism.

What can Pegasus spyware do?

• Pegasus spyware exploits zero-day vulnerability in the targeted devices to gain the access.
• The spyware is supposed to attack devices without any active interaction from the individual who is targeted by it.
• It was specifically designed to target mobile devices running on both iOS and Android devices.
• Once installed successfully, it can secretly harvest the necessary information from those devices.
• The spyware is known for its high level of sophistication and is even capable of pervasive espionage and data collection.
• This data collection ranges from reading text messages and emails, tracking calls, monitoring app usage, harvesting passwords, accessing personal files (including photos and anything else in local storage), location tracking, and remote access to the device’s microphone and camera.

What is a zero­click exploit?

• A zero­click exploit generally refers to the malicious software which allows spyware to be installed on a device without the device owner’s authorization.
• Most importantly, it doesn’t even require the device owner to perform any actions to initiate or complete the installation.
• The owner of the device is completely unaware of the whole action.
• The specific exploit allegedly in use on the above two devices is called as the BLASTPAST (previously identified as BLASTPASS).
• It performs action mainly in two phases.
• In the first phase, the attack tries to establish a link with the Apple HomeKit that gives users a way to control multiple smart devices on the target’s device.
• In the second phase, some malicious content is sent through the iMessage app to the target.