What is Pegasus Spyware?

What is Pegasus Spyware?

If you have been on the internet recently you may have seen the topic of Pegasus come up over and over again. This spyware has been the topic of many different news stories, with many individuals concerned about its ability to discreetly spy on users and smartphones. Some stories even report that the spyware is able to infiltrate fully updated smartphones via a single text message, and many are concerned about how difficult it can be to detect this spyware on devices. In fact, the concern over this software has sparked an international investigative journalism initiative entitled “the Pegasus Project” in order to reveal more about this spyware. Here is what we know about this spyware so far. 

What is Spyware? What does Pegasus do?

Named after the mythical winged horse, Pegasus is a spyware developed by a company called NSO Group. Spyware is exactly what it sounds like, it is malicious software that is designed to infiltrate your devices and gather information for a third party without consent. There are many different purposes of spyware but typically the goal is to steal sensitive information about the user, including internet usage data, bank information or personal identity. Pegasus in particular infects a user’s smartphone and collects information on photos, messages, passwords, location tracking and audio/video recordings for a third party. Even more terrifying, Pegasus can reportedly turn on the smartphone’s cameras and microphones to make covert recordings. 

Before, it seemed that Pegasus had to be deployed through phishing links that the smartphone users had to click on. However, recent versions of the software seem to show that the spyware can be deployed without the user doing anything or knowing. A link is sent to the smartphone without a notification to the user, and then Pegasus is able to start collecting information. 

Who is NSO Group? 

The developers behind Pegasus are an Israeli company called NSO Group. This company has publicly stated that it will only work with government agencies and claims that they have and will cut off agencies that abuse the software. The firm claims that they provide “authorized governments with technology that helps them combat terror and crime” and have extensive contracts requiring clients to use their products exclusively for criminal and national security investigations. However, this company still remains at the center of controversy, especially with the provision of this spyware to oppressive governments. There are many further stories and investigations that point to the abuse and improper use of this spyware. 

Who is using Pegasus? Who is being spied on?

At the moment, it seems that there are conflicting views and no conclusive answers. There were reports of a list of over 50,000 phone numbers being leaked, these numbers are believed to be people of interest to the clients of Pegasus/NSO. The Pegasus Project analysed these numbers, linking over 1,000 of them to their owners, and reported that many of the phones with numbers on the list were targeted with Pegasus spyware. The individuals on the list were found to range from politicians, government workers (including three presidents, ten prime ministers and a king) to journalists and human right activists. Many of these individuals should not be targets of Pegasus spyware according to the NSO Group’s contract to only use the spyware on criminal and national security investigations. 

In response to the list, the NSO Group claimed that the list was unrelated to them and the information comes from an unreliable source. So it seems as of this moment, there is no certainty where the list came from or what it exactly means. However, it does appear that there is some connection between this list and individuals that are being targeted by the spyware. 

Long History of Spyware

This is not the first time this spyware has made headlines. In fact it has been in use for several years now. The spyware first surfaced in 2016, making headlines after it was discovered following a failed installation attempt on the mobile phone of a human rights activist. In 2017 the spyware was connected to attacks against Mexican reporters and activists. In 2019, NSO Group was sued by WhatsApp; the software developer was accused of hacking over a thousand devices with an exploit found from WhatsApp’s code. In 2020, the developers were investigated by the FBI regarding a hack of Jeff Bezos’ cellphone. Finally, most recently in July of 2021, the investigative journalists behind the Pegasus Project reported the ongoings of the spyware and its most recent use. 

Are all phones vulnerable?

It seems that Pegasus is able to infiltrate all smartphones (and other devices) that run iOS and Android. It appears that even smartphones that are fully updated can still be vulnerable to this spyware. As of this moment, Apple and Google have both commented on the spyware, condemning its use and warning their users. 

What other forms of spyware are there?

Pegasus is not unique. Currently there are many high profile companies working to develop similar types of spyware. 

How Can I Keep Myself Safe? Is my Phone Compromised?

For the moment, it appears that the spyware is only being used to target world leaders, journalists and other individuals in positions to threaten governments. Unless you fall into any of those categories, it is unlikely that your phone would be targeted - as the implementation of this software is extremely costly. This is not to say that these attacks are not dangerous, in fact they point to a concerning future where these attacks may become increasingly normalized or targeted towards a wider population. However, it is to reassure the average individual that they are unlikely to be a victim of this exact form of spyware. 

There are, however, many other threats to the average individual. There are still hackers and cybercriminals that operate on smaller levels and are likely to attack everyday people. Thus, good cybersecurity practices are essential to protecting yourself from these types of attacks. Here is a list of some security practices you can implement today:

‍

1. Keep Your Phone Updated to the Latest Software

‍

2. Use Strong and Unique Passwords

‍

3. Turn on Encryption

‍

4. Use Two or Multi Factor Authentication

‍

5. Beware of Phishing Scams

‍

6. Sign up for Cyber Unit's mobile security service

What’s Next?

Does your smartphone collect more information from you than you expected? You would not be the first person to be surprised and concerned about your own privacy. There are many steps you can take to ensure that your private information stays private. Click here if you are interested in learning more about how to secure your information.