An insider reveals how the nasty spyware used in the WhatsApp breach lets governments secretly access everything in your smartphone, from text messages to the microphone and cameras
What happened with WhatsApp?
On Monday, Whatsapp issued a software update to its 1.5 billion-plus users.
The reason was simple: The update aimed to patch a massive security flaw wherein hackers could infect target phones simply by calling that phone through WhatsApp.
You didn't need to accept the call, and records of the call could even be erased remotely after the fact — as though a burglar virtually broke into your phone, took whatever they wanted, and didn't leave a trace.
"The way to think about this is like using WhatsApp as a vector," Scott-Railton told Business Insider. "If indeed this is NSO, their job is to find novel vectors so they can always offer their customers access to phones. And WhatsApp is just another on the list."
Simply put: The WhatsApp security flaw was a new way for hackers to infect smartphones with malicious software.
WhatsApp fixed its security hole, but not before at least one target was impacted: an unidentified, UK-based human rights lawyer.
What is Pegasus?
What Pegasus actually does is relatively simple: Once a smartphone is infected with Pegasus, the application provides direct access, remotely and discreetly, to the entirety of your smartphone.
Everything from text messages to using your smartphone's camera and microphone are up for grabs. The spyware was created by an Israeli company, the NSO Group, and it's nothing new.
Pegasus was first discovered in 2016 when a man in the United Arab Emirates named Ahmed Mansoor was targeted with "suspicious text messages," Scott-Railton said.
"Those text messages actually came bearing some suspicious links," he said. "We thought they looked pretty dicey, so my colleague Bill [Marczak] borrowed a colleague's iPhone, clicked on the links, and was able to successfully get the phone infected with what was then a mystery piece of spyware."
That "mystery" spyware was actually Pegasus, and Mansoor was being targeted — likely due to his work as a human rights advocate. Mansoor is currently serving a 10-year prison sentence in the UAE for publicly criticizing the government.
How do you know if your phone is infected with spyware like Pegasus? If the hackers are doing their job right, it's extremely difficult to find out.
If your phone is infected with spyware like Pegasus, it probably won't start suddenly overheating or ripping through battery life. If that were the case, "then the people who did it have not done their jobs right," Scott-Railton said.
In fact, if you're not a cybersecurity researcher, it's nearly impossible to know.
"It's quite tricky because the software is of course designed to be hard to find," Scott-Railton said. "What we did in the first instance was we actually captured the network traffic going into the phone after the [link] was clicked, and that gave us the infection."
Unless you're monitoring the network traffic going into your smartphone, and also savvy enough to know what type of network traffic could demonstrate malicious behavior, it's extremely unlikely you'd know that spyware like Pegasus was running on your device.
Who makes Pegasus? And how is it used?
Pegasus is intended as a cyberweapon for use by international governments.
An Israeli company named NSO Group operates it, and the Israeli Ministry of Defense is said to regulate sales of the software outside of Israel.
"We are selling Pegasus in order to prevent crime and terror," NSO Group CEO Shalev Hulio told "60 Minutes" in an interview earlier this year. "Intelligence agencies came to us and say, 'We do have a problem. With the new smartphones, we can't get valuable intelligence.'"
An unnamed European security official confirmed to "60 Minutes" that NSO Group software had been used to thwart terrorist attacks in Europe.
"It wouldn't surprise me to know that some of NSO's claims about being used to go after criminals are correct," Scott-Railton told Business Insider on Wednesday. "The issue is that the fact that it's used lawfully doesn't falsify all these abuse cases.
What are some Pegasus abuse cases?
Pegasus has been linked to the death of Washington Post reporter Jamal Khashoggi, and it was used to track a student in Canada who was critical of the Saudi Arabian government.
"His name is Omar Abdulaziz," Scott-Railton said. "He's a Saudi critic going to college in Montreal. We found that his infected phone was bouncing back and forth between his home network and his university gym over last summer."
A similar story played out in Mexico in 2017:
"We had this crazy case that I found in Mexico back in 2017 where three people — a nutrition activist, a public health researcher, and a consumer advocate — were all targeted with Pegasus in Mexico.
The only thing that holds them in common is that they were all advocating to slightly increase the tax on soda beverages. So the most reasonable implication is that somebody from a private interest directed somebody from the government in order to target these people because they were pushing against the soda lobby in Mexico. State-grade malware — it'd be like targeting somebody with Stuxnet because they had suggested there be a ten cent bottling fee on Coca-Cola."
What can you do?
First and foremost, you should update WhatsApp to seal up that security hole.
"We're reasonably satisfied that we watched WhatsApp block an infection attempt," Scott-Railton said.
He also encouraged people to not lose faith in encrypted messaging apps like WhatsApp simply because of this one security flaw. "Users should not lose confidence in encrypted messaging at all," he said. "Encrypted messaging is important."
Outside of that, there's not much else you can do outside of giving up on smartphones altogether.
He offered a final warning: "Readers should be concerned that there are companies finding, stockpiling, and selling these really powerful vulnerabilities that make us all less secure."
Next Story
PM's visit to vaccine centres gets 'praise' from Congress
-
Pollution, pandemic and pre-term birth
-
Serum Institute of India threatens to seek ₹100 crore in damages from Chennai volunteer
-
PM to interact with more teams of Covid-19 vaccine developers
-
UP to have cold chain space for 1.23L litres of vaccine
