Once installed on a phone, Pegasus can harvest more or less any information or extract any file. SMS messages, address books, call history, calendars, emails and internet browsing histories can all be exfiltrated.
TFM Desk
Over the past few days, news portal The Wire, which is part of an international media consortium — Project Pegasus, has published a series of stories on how Pegasus spyware was used to hack or tried to hack phones of several journalists, human rights activists, opposition leaders, union ministers and others in India.
India’s main opposition Congress party has accused Prime Minister Narendra Modi of “treason” and compromising national security following revelations that dozens of Indians were potential targets of snooping by the Israeli-made spyware.
More than 1,000 phone numbers in India were among nearly 50,000 selected worldwide as part of a large database of leaked numbers believed to be drawn up by NSO Group clients and accessed by the French media nonprofit Forbidden Stories and shared with 16 news organisations, including The Wire, The Guardian, Washington Post, Le Monde, and Haaretz.
In India, The Wire reported, several of these phone numbers were added to the list between 2017 and 2019, and in the run-up to the 2019 Lok Sabha election.
The list includes Congress MP Rahul Gandhi and poll strategist Prashant Kishor (who masterminded the Trinamool’s victory over the BJP in Bengal). Forensic analysis indicated Kishor’s phone was compromised as recently as July 14, The Wire reported.
Other public figures that were potentially targeted included former Election Commissioner Ashok Lavasa, BJP union ministers Ashwini Vaishnav and Prahlad Patel, amongst others.
The Wire said there was not enough evidence to suggest all phones on the list had been hacked, but forensic tests on some phones associated with target numbers revealed signs of Pegasus activity.
Speaking in Parliament on Monday, IT Minister Ashwini Vaishnaw – whose number was also on the list, according to The Wire, slammed the release of “over-the-top” media reports, and said it “can’t be a coincidence” they were published a day before the start of Parliament’s monsoon session.
The row prompted fierce protests from the opposition on Monday — the first day of the Parliament’s monsoon session — with Prime Minister Modi faced with slogans and shouting as he spoke.
NSO Group has, however, denied these reports. “After checking their claims, we firmly deny the false allegations made in their report. Their sources have supplied them with information which has no factual basis, as evident by the lack of supporting documentation for many of their claims,” the group said in a statement on Monday.
“We would like to emphasize that NSO sells its technologies solely to law enforcement and intelligence agencies of vetted governments for the sole purpose of saving lives through preventing crime and terror acts. NSO does not operate the system and has no visibility to the data,” it added.
Pegasus Spyware
Pegasus is the hacking software – or spyware – that is developed, marketed and licensed to governments around the world by the Israeli company NSO Group. It has the capability to infect billions of phones running either iOS or Android operating systems.
The earliest version of Pegasus discovered, which was captured by researchers in 2016, infected phones through what is called spear-phishing – text messages or emails that trick a target into clicking on a malicious link, according to The Guardian.
Since then, however, NSO’s attack capabilities have become more advanced. Pegasus infections can be achieved through so-called “zero-click” attacks, which do not require any interaction from the phone’s owner in order to succeed. These will often exploit “zero-day” vulnerabilities, which are flaws or bugs in an operating system that the mobile phone’s manufacturer does not yet know about and so has not been able to fix.
In 2019 WhatsApp revealed that NSO’s software had been used to send malware to more than 1,400 phones by exploiting a zero-day vulnerability. Simply by placing a WhatsApp call to a target device, malicious Pegasus code could be installed on the phone, even if the target never answered the call. More recently NSO has begun exploiting vulnerabilities in Apple’s iMessage software, giving it backdoor access to hundreds of millions of iPhones. Apple says it is continually updating its software to prevent such attacks.
Once installed on a phone, Pegasus can harvest more or less any information or extract any file. SMS messages, address books, call history, calendars, emails and internet browsing histories can all be exfiltrated.
One of the most significant challenges that Pegasus presents to journalists and human rights defenders is the fact that the software exploits undiscovered vulnerabilities, meaning even the most security-conscious mobile phone user cannot prevent an attack, The Guardian noted.