Context: The Pegasus Project, an investigation by an international media consortium, has revealed that more than 50,000 phone numbers were targeted by a spyware created by NSO Group, an Israeli software company. On the list were 300 verified phone numbers in India, including those of ministers, opposition leaders, a sitting judge, more than 40 journalists, and several activists and business persons.In this edition of Big Picture we analyse the Pegasus spyware controversy.

• It may have been used to conduct surveillance on about 300 Indians including two Cabinet ministers three opposition leaders, a Constitutional authority, government officials, scientists and about 40 journalists.

About Pegasus

• It is a spyware created by NSO Group, an Israeli cybersecurity firm founded in 2010.
• Pegasus spyware can hack any iOS or Android device and steal a variety of data from the infected device.
• It works by sending an exploit link and if the target user clicks on the link, the malware or the code that allows the surveillance is installed on the user’s phone.
• Once Pegasus is installed, the attacker has complete access to the target user’s phone.

The key features of Pegasus are

• Ability to access password-protected devices;
• Being totally transparent to the target;
• Leaving no trace on the device;
• Consuming minimal battery, memory and data so as to not arouse suspicion in more alert users;
• A self-destruct mechanism in case of risk of exposure; and
• Ability to retrieve any file for deeper analysis

Worrying Aspect of Pegasus Spyware

• One of the worrying aspects of the Pegasus spyware is how it has evolved from its earlier spear-phishing methods using text links or messages to ‘zero-click attacks.

What is a Zero Click Attack?

• A zero-click attack helps spyware like Pegasus gain control over a device without human interaction or human error.
• So all awareness about how to avoid a phishing attack or which links not to click is pointless if the target is the system itself.
• Most of these attacks exploit software that receives data even before it can determine whether what is coming in is trustworthy or not, like an email client.

Evolution of Pegasus Spyware

• In 2016, It infected smartphones using a technique called “spear-fishing”: the hackers send malicious links to the target via text messages and emails.
• In 2019, Pegasus was able to infiltrate a device with a missed call on WhatsApp and could even delete the record of this missed call. This makes it difficult for the user to know that they were targeted.
• In the same year, WhatsApp said Pegasus exploited a bug in its code to infect more than 1,400 iPhones and Android phones. These include journalists, government officials and human rights activists. It soon fixed the bug.
• July 2021: The Pegasus Project, an international investigative journalism effort, revealed that various governments used the software to spy on opposition politicians, government officials, activists, journalists and many others. It said the Indian government used it to spy on around 300 people between 2017 and 2019.

International Mechanisms to Mitigate Cybercrime

• Budapest Convention is an international convention It seeks to address Internet and computer crime (cybercrime) by improving investigative techniques, harmonizing national laws, and increasing cooperation among nations. It came into force on 1st July 2004. India is not a signatory to this convention.
• International Telecommunication Union is a specialized agency within the United Nations. It plays an important role in the development and standardisation of telecommunications and cybersecurity issues.

How can one detect the Pegasus Spyware?

• Researchers at Amnesty International have developed a tool to see whether your phone is targeted by spyware. The tool is called Mobile Verification Toolkit (MVT), the tool is aimed to help you identify if the Pegasus spyware has targeted your phone. It works with both Android and iOS devices.
• NSO’s Stand on the Issue
• The NSO has said that it sells its technologies only to law enforcement and intelligence agencies of governments for the purpose of saving lives through preventing crime and terror acts.
• The group said, It does not operate the system and has no visibility to the data.
• As per the company’s website, NSO products are used exclusively by government intelligence and law enforcement agencies to fight crime and terror.

Road Ahead

• Providing as much information on the Pegasus Spyware to software and security vendors can help to fix the vulnerabilities exploited by the attackers. The governments must take measures such that Spyware is not misused by political parties and intelligence institutions.
• The Pegasus spyware is a serious problem, snooping is not a new thing but the way it is being done by the NSO group is scary. It is like something which we never seen it before and its far ahead of its time like a supersonic jet in the early 1900s. There is very little that we can do when tech giants like apple and google are themselves helpless against such spyware and that is what is extremely worrying. The onus is on the operating system manufacturer is to develop some kind of security net against the spyware. Also the government need to deal with from G2G level and speak to the Israel and try to get to the bottom of it because we the people of this country and world deserve to know the truth and deserve to know what exactly is going on