All about Pegasus!

It did happen again. Even as most of us were touting Whatsapp to be the most secure messaging platform, another attack on the world’s most popular messanging platform shook everybody…again!

As an introduction, Whatsapp is end-to-end encrypted messaging platform that was supposedly the most secure communication. From Whatsapp’s own website, “your messages and calls are secured so only you and the person you’re communicating with can read or listen to them, and nobody in between, not even WhatsApp” India is also the biggest market for Whatsapp. According to one report, from July 26, 2019,  Whatsapp reached 400 million users in India thus establishing its dominance in the Indian market. (WhatsApp reaches 400 million users in India, its biggest market, 2019)

So, what happened then?

Israeli origin ‘Pegasus’ spyware apparently targeted the phones of Indian journalists, civil rights activists, lawyers in Maharashtra, Chhattisgarh and Goa along with individuals from other countries.

It challenged Whatsapp’s end-to-end encryption and broke into the conversations and spied on their conversations and contacts!

Here are a few details about Pegasus:-

1. The ‘Pegasus’ spyware installed itself on the phones of various individuals by means of Whatsapp call.
2. The affected individuals did not need to even answer the call for the spyware to install!
3. A vulnerability in Whatsapp’s voice call was exploited to remotely execute the code associated with the spyware
4. Once the spyware installs itself, it sends the users contacts, calls and messages and every minute detail about the user back to the controller. It can further sit untraced on the phone and be used to spy on the innocent users phone.
5. It was created by the Isreali firm, NSO group and it affects both Android and Apple devices.
6. The Apple version was created first and the Android version followed soon after
7. It was originally discovered by Ahmed Mansoor a human rights activist from UAE
8. The number of users affected by the Pegasus malware currently stands at 1400
9. The Pegasus malware can also be used on Facebook Messenger, Telegram, iMessage, Skype and WeChat
10. It is virtually untraceable, consumes very low battery and it can destroy itself at any point of time(Pegasus: A spyware that leaves no trace, 2019)
11. It works in three stages – initial extraction, passively sitting and monitoring and continuous collection of personal data
12. It is quite a possibility that Pegasus may have spread into other devices too

How do we know if we are affected by the Pegasus spyware:

Unfortunately, as of today, the only way you will know if you are infected by the spyware is if Whatsapp itself informs you of the attack.

What has been done so far?

Apple has sealed the vulnerability by security update 9.3.5. Google has said that it identifies phones that are infected and disables them.

What you can do:

1. Always apply patches and security updates as and when available
2. Uninstall and reinstall software as and when necessary
3. Change passwords every 3 months or so
4. With everything going digital, it is always good to keep an open eye on the security landscape and keep track of attacks and breaches around us

Even as the politics around the encrypted messaging platform attack continues, it is a sure bet that these types of attacks will continue into the future!

Bibliography

Pegasus: A spyware that leaves no trace. (2019). Retrieved from economictimes.com: https://economictimes.indiatimes.com/tech/internet/pegasus-a-spyware-that-leaves-no-trace/articleshow/71848150.cms WhatsApp reaches 400 million users in India, its biggest market. (2019). Retrieved from techcrunch.com: https://techcrunch.com/2019/07/26/whatsapp-india-users-400-million/

AUTHOR
Jayanthi Manikandan ( )
Cyber Security Analyst

“ Jayanthi Manikandan has a Master’s degree in Information systems with a specialization in Information Assurance from Walsh college, Detroit, MI. She is passionate about Information security and has been writing about it for the past 6 years. She is currently ‘Security researcher at InfoSec train. “