The Digital Age

Espionage in the Digital Age

With the revelation of espionage carried out by some governments using Pegasus software, it is clear that mobile devices have no privacy.

An investigation conducted by a group of media outlets revealed widespread misuse of spy software known as the Pegasus and developed by the Israeli company NSO Group. Pegasus is malware that can infect Android and iOS mobile devices. By installing Pegasus remote operators can gain unauthorized access to everything on the mobile device: they can retrieve all SMS messages that the user has ever sent or received, emails, including those encrypted via WhatsApp and Signal, photos and videos, calendar and contacts lists, GPS location information, record phone conversations and video calls, and activate the camera and microphone.

According to the NSO Group, which sells the software to governments, the equipment is only meant to be used against criminals and terrorists. However, media outlets investigating the public data discovered that authoritarian governments all over the world used Pegasus to target primarily human rights activists, journalists, and lawyers.

Digital weapon

According to Miha Lavrič, a cyber security expert and certified ethical hacker CEH from the company CREAplus, who deals with the comprehensive provision of cyber security, the most intriguing aspect is the perfection of the mentioned spy software and its good concealment on mobile devices. »It is a top spy tool that has been adapted to the digital age that we live in,« Lavrič concludes.

Mitja Trampuž, managing director of CREAplus and a certified information systems security professional CISSP, believes Pegasus is a modern digital weapon: »Pegasus is classified as a weapon by the Israeli government itself, and its export requires an export license, as is the case with most military and cryptographic equipment.«

Simple infection and invisibility

When installing malware, attackers frequently take advantage of a zero-day vulnerability, which is a security flaw that the manufacturer is unaware of or has not yet fixed. The black market is willing to pay a high price for such a flaw. »There are zero-day vulnerabilities in the Android and iOS operating systems, as well as the majority of applications, making it difficult to say that any mobile phone is truly safe,« says Lavrič.

Pegasus relatively easily infects a mobile phone and then intercepts and collects data or monitors the device. It combines various hacker and spy tools into a single platform with a user-friendly interface, making controlling the target device relatively simple. The infection is difficult to detect and difficult to remove; its existence can only be determined by analysing the device's data traffic with the environment, as the software sends data from the mobile device to control centres, or by a more complex forensic analysis of the mobile device conducted by specialized companies in the field of cyber security.

Protection options

The most drastic and impractical anti-spying measure with Pegasus is for the user to give up the mobile device. Without a smartphone, Pegasus can’t attack anything.

A slightly more practical approach would be for the user to refrain from bringing their phone to sensitive appointments. One should also ensure that no one else in the meeting is carrying a smartphone. It is also possible to disable certain smartphone functions, such as the camera, which was also introduced by Edward Snowden in 2016.

»One of the current options for ensuring secure digital communication, for example, is to use a mobile device that is prepaid and only used once. It's about preventing the device from linking to the user's identity,« explains Lavrič. »Such a mobile device needs to be properly discarded or replaced after sensitive communication. If you want to use your own phone, the most important thing is to keep it up to date and to install updates as soon as they become available. Above all, you never click on a link you receive unless you are absolutely certain that the link is genuine and secure. You do not click on the link if you have even the slightest doubt.«

There is no privacy

Pegasus is considered cutting-edge spyware that can be used to conduct the most intrusive digital human surveillance currently imaginable. »The disclosure of Pegasus misuse will undoubtedly change any beliefs we may have had about privacy in the digital age,« Trampuž concludes.

Photo: TechCrunch / PhotoMosh