Special services staged mass surveillance of journalists around the world with the help of Spy on Israeli NSO Group. Main

The press got 50 thousand numbers, which were followed with vulnerabilities in smartphones, the company claims that it was sold according to special services only.

The authorities of at least ten countries used the Software of the Israeli company NSO Group for mass surveillance of journalists, activists, businessmen and politicians. The Pegasus program allowed to secretly monitor tens of thousands of people with the help of unknown vulnerabilities in smartphones. TJ tells the main thing about the scandal.

What's happened

On July 19, almost two dozens of foreign media, including The Washington Post and Guardian, published a joint investigation, which was supported by Amnesty International human rights activists. The material said about the Spy program of PEGASUS, which the Israeli company NSO Group sold to the authorities of different countries to survive activists, investigators, opposition and dissidents.

tjournal.ru Media: Kazakhstan, Azerbaijan and nine more countries used the Spy PEGASUS program to monitor journalists - news on TJ program allows you to secretly and remotely collect data from other people's phones.

Among the clients of the company were the countries of the former USSR, including Kazakhstan and Azerbaijan. In the latter case, the victim of PEGASUS was the journalist Hadija Ismailov - she is considered one of the main investigators in the country. She spent a year and a half in prison due to accusations of tax evasion and embezzlement, although human rights activists called the case as fabricated.

The investigation of journalists about Pegasus is based on a list of at least 50 thousand telephone numbers that are in the surveillance database. The Washington Post managed to recognize only about a thousand people from the list: they turned out to be activists, oppositionists and journalists of the Hungarian, Azerbaijan, Kazakhstan, India, Israel, Bahrain, Mexico, Morocco, Rwanda, Saudi Arabia or the UAE.

The list also found large businessmen and top managers, members of the royal families of Arab countries, at least 85 human rights activists and more than 600 politicians. Among the goals of the program were also close to the activist Jamal Khashukji, who was killed at the Saudi Arabian Consulate, - his wife and bride.

Journalists managed to confirm at least 37 cases of hacking smartphones using Pegasus. To do this, they examined 67 smartphones, the owners of which were on the list - at 23 they found traces of the program, and at 14 they found traces of penetration.

What does NSO Group do

The official website of the Israeli company says that it is conducting "cyber intelligence in the interests of global security." One of the main NSO Group products is the Pegasus complex, which allows to secretly and remotely access data on smartphones.

NSO Group is one of many companies that were founded by the former military resigned in Israel. At the source of the company are immigrants from the 8200 unit, which is engaged in electronic intelligence - they initially were going to create a program for remote hacking of devices. As planned by the founders of the NSO Group, the development would help the authorities fight terrorism and crime.

Formally, it was developed to combat crime, and the company claims that it sells licenses for the authorities of different countries only in exceptional cases after the approval of the Israeli government. Officially, among clients, at least 60 power structures of 40 states, but which ones do not specify the NSO Group.

According to journalists, one of the largest customers is Mexico - it accounts for 15 thousand telephone numbers out of 50 thousand who came to journalists. In the list of goals of politics, representatives of trade unions, journalists and opposition. Another major customer is India - hundreds of numbers are on it.

At least a few dozen times of surveillance ordered the authorities of Hungary: they hacked the smartphones of lawyers, oppositionists and five journalists. For example, the smartphone of the Sabolcha reporter has infected repeatedly, and at about the same time when he sent requests to officials about sensitive topics.

How PEGASUS works

For the first time, PEGASUS became known in 2016: then the journalist Ahmed Mansur received a suspicious link in SMS publication and contacted experts from Citizen Lab. They found out that a malicious code was hidden behind the link, which made it possible to hack the iPhone remotely using a combination of zero -day vulnerabilities - this made it possible to get full access to the function and memory of the device.

In 2018, researchers recorded PEGASUS traces in 45 countries from Mexico to India. And a year later, the NSO Group became a defendant in the scandal due to Facebook: WhatsApp developers learned about the vulnerability that the company operated and went to court. The bug in the code allowed to call the victim and install the spy program, even if the user did not pick up the phone. The court did not lead to anything, but it turned out that Facebook itself wanted to gain access to PEGASUS.

The exact mechanism of the program is a secret, moreover, the methods are constantly changing. PEGASUS allows you to get full access to the device remotely and without traces: you can view correspondence, receive location, turn on a camera or microphone.

The NSO Group uses the unanimated vulnerabilities of iOS and Android, which allow you to hack iPhones even with the latest updates and without the participation of the victim - you do not need to open links or enter passwords. Amnesty International suggests that they use the vulnerability of applications, but only a bug in the Imessage messenger, which is set by default on all iPhone, was confirmed .

During the investigation, the researchers used several 0-day-vazimenities at once and hacked the iPhone 12 from the last iOS 14.6 at that time without the user's knowledge. For attack vectors, the JPG and GIF Parsers were used, as well as other methods.

Consequences: NSO Group denies everything, Apple and Amazon react to vulnerabilities

Before the investigation, the NSO Group claimed that they grant the rights to technology only "in exceptional cases after coordination with the Israeli government." Formally, this is true: the export of technologies controls the country's Ministry of Defense, but the department does not control startups too closely.

After the publication of the investigation, the NSO Group called the number of victims of 50 thousand people “exaggerated”, and the conclusions are “incorrect”. Lawyers of the company said that the base of numbers could be assembled using technologies unrelated with PEGASUS.

On their website, company representatives spoke more sharply. They called the sources of the investigation inaccurate, and the data was "far from reality." The NSO Group emphasized that they have nothing to do with the murder of Jamal Hashukji, and also do not store any data on their servers.

We would like to emphasize that NSO sells technologies to government and intelligence services for the sole purpose - to preserve life, preventing crimes and terrorism. NSO does not control systems and does not see any data.

NSO Group

Apple said that they consider their devices the most protected in the consumer market and emphasized the aiming nature of attacks. According to representatives of the company, they cannot affect the mass audience, but will continue to fight with vulnerabilities.

The described attacks are very sophisticated, their development costs millions of dollars, they often have a short life and are aimed at individuals. And although they do not threaten the overwhelming majority of our users, we will continue to work tirelessly to protect all consumers.

Ivan Krstich

Amazon stopped and blocked the work of the NSO Group account on their cloud hosting for no formal reason. At the same time, the company can turn to the services of any other provider: the server was used only to transfer content.

The researchers of Amnesty International have published a tool to check their smartphone for infection Pegasus. The program works on iOS and Android and so far allows you to detect traces of the penetration of the spy program.

Edward Snowden, in a conversation with The Guardian, called for prohibiting spy trade globally and at the legislative level. In his opinion, this is comparable to the sale of weapons of mass destruction, so the countries should abandon this practice.

#analysis #espionage #special services #pegasus