Pegasus (spyware)

Pegasus is a spy software installable on iOS devices that allows the reading of messages, emails, passwords and address lists as well as eavesdropping on phone calls, making and transmitting audio recordings, and tracking the location on a compromised device.^[1] The list of surveilled programs includes Gmail, Facebook, Skype, WhatsApp, FaceTime, Apple Calendar, WeChat,^[1] Viber,^[2] iMessage and Telegram.^[3] iOS update 9.3.5, released 25 August 2016, removes the vulnerabilities,^[4] and details of the exploit were made available at that time. Pegasus is the first remote jailbreak used in a targeted attack that has been discovered.^[5]

iOS versions as early as iOS 7 are affected,^[6][7] up to and including version 9.3.4.^[4] At the time of discovery, this included 97% of iOS devices,^[8] and virtually all^[9] of the 1 billion^[10] iPhones sold.

IT security firm Lookout and University of Toronto–based Citizen Lab jointly uncovered the three vulnerabilities involved in the hack—a privilege escalation, a memory management bug that can cause kernel memory to be exposed, and a WebKit bug allowing code execution from knowingly crafted websites.^[11] Additionally, the malware uses strong encryption to evade discovery.^[12]

The software is alleged to originate with Israeli company NSO Group^[2] and to have been used against human rights campaigners and journalists,^[4] possibly at the behest of the United Arab Emirates government.^[13] The discovery came after human rights lawyer Ahmed Mansoor submitted a link for analysis that he considered suspicious.^[2] Apple Inc. fixed the vulnerability within ten days of its discovery.^[4]

Subsequent media discussion focused on the implications for user trust in smartphones^[14] as well as details about the company alleged to have carried out the hack.^[15]

See also

• FinFisher

References