Explained: What is Israeli spyware Pegasus, which carried out surveillance via WhatsApp?

The surveillance was carried out “between in and around April 2019 and May 2019” on users in 20 countries across four continents, WhatsApp said in its complaint.

In an Op-ed in The Washington Post, the head of WhatsApp, Will Cathcart, wrote that the surveillance “targeted at least 100 human-rights defenders, journalists and other members of civil society across the world”. He underlined that “tools that enable surveillance into our private lives are being abused, and the proliferation of this technology into the hands of irresponsible companies and governments puts us all at risk”.

WhatsApp, which is owned by Facebook, is the world’s most popular messaging app, with more than 1.5 billion users worldwide. About a quarter of those users — more than 400 million, or 40 crore — are in India, WhatsApp’s biggest market.

The NSO Group is a Tel Aviv-based cyber-security company that specialises in “surveillance technology” and claims to help governments and law enforcement agencies across the world fight crime and terrorism.

So what exactly is Pegasus?

All spyware do what the name suggests — they spy on people through their phones. Pegasus works by sending an exploit link, and if the target user clicks on the link, the malware or the code that allows the surveillance is installed on the user’s phone. (A presumably newer version of the malware does not even require a target user to click a link. More on this below.) Once Pegasus is installed, the attacker has complete access to the target user’s phone.

The first reports on Pegasus’s spyware operations emerged in 2016, when Ahmed Mansoor, a human rights activist in the UAE, was targeted with an SMS link on his iPhone 6. The Pegasus tool at that time exploited a software chink in Apple’s iOS to take over the device. Apple responded by pushing out an update to “patch” or fix the issue.

In September 2018, The Citizen Lab, an interdisciplinary lab based at the Munk School of Global Affairs & Public Policy, University of Toronto, showed that Pegasus delivers “a chain of zero-day exploits to penetrate security features on the phone and installs Pegasus without the user’s knowledge or permission”. Pegasus spyware’s operations were live in 45 countries at the time, The Citizen Lab research showed.

(A “zero-day exploit” is a completely unknown vulnerability, about which even the software manufacturer is not aware, and there is, thus, no patch or fix available for it. In the specific cases of Apple and WhatsApp, therefore, neither company was aware of the security vulnerability, which was used to exploit the software and take over the device.)

In December 2018, Montreal-based Saudi activist Omar Abdulaziz lodged a case against the NSO Group in a court in Tel Aviv, alleging that his phone had been infiltrated using Pegasus, and conversations that he had with his close friend, the murdered Saudi dissident journalist Jamal Khashoggi, snooped on. Khashoggi was slaughtered by Saudi agents at the kingdom’s consulate in Istanbul on October 2, 2018; Abdulaziz said he believed his phone was hacked in August that year.

In May 2019, the Financial Times reported that Pegasus was being used to exploit WhatsApp and spy on potential targets. WhatsApp issued an urgent software update to fix the security bug that was allowing the spyware to exploit the app.

Once installed, what all can Pegasus do?

The Citizen Lab post said Pegasus can “send back the target’s private data, including passwords, contact lists, calendar events, text messages, and live voice calls from popular mobile messaging apps”. The target’s phone camera and microphone can be turned on to capture all activity in the phone’s vicinity, expanding the scope of the surveillance. According to claims in a Pegasus brochure that WhatsApp has submitted to court as a technical exhibit, the malware can also access email, SMS, location tracking, network details, device settings, and browsing history data. All of this takes place without the target user’s knowledge.

Other key features of Pegasus, according to the brochure are: ability to access password-protected devices, being totally transparent to the target, leaving no trace on the device, consuming minimal battery, memory and data so as to not arouse suspicion in more alert users, a self-destruct mechanism in case of risk of exposure, and ability to retrieve any file for deeper analysis.

The brochure, called Pegasus: Product Description, says Pegasus can work on BlackBerry, Android, iOS (iPhone) and Symbian-based devices. The mention of the now discontinued mobile OS Symbian and the no longer popular BlackBerry suggests the document is old — and Pegasus has certainly been upgraded over the years.

And how did Pegasus exploit WhatsApp?

That’s the big question for many, given that WhatsApp has always tom-tommed its end-to-end encryption. The Financial Times report in May this year said that a missed call on the app was all that was needed to install the software on the device — no clicking on a misleading link was required. WhatsApp later explained that Pegasus had exploited the video/voice call function on the app, which had a zero-day security flaw. It did not matter if the target did not take the call — the flaw allowed for the malware to be installed anyway.

The exploit impacted WhatsApp for Android prior to v2.19.134, WhatsApp Business for Android prior to v2.19.44, WhatsApp for iOS prior to v2.19.51, WhatsApp Business for iOS prior to v2.19.51, WhatsApp for Windows Phone prior to v2.18.348, and WhatsApp for Tizen (which is used by Samsung devices) prior to v2.18.15.

Express Cartoon by E P Unny.

Can Pegasus be used to target just about anyone?

Technically, yes. But while tools such as Pegasus can be used for mass surveillance; it would seem likely that only selected individuals would be targeted. In the present case, WhatsApp has claimed that it sent a special message to approximately 1,400 users who it believed were impacted by the attack, to directly inform them about what had happened.

WhatsApp has not said how many people it contacted in India. The Indian Express reported on Thursday that at least two dozen academics, lawyers, Dalit activists, and journalists were alerted by the company in India.

It is not known who carried out the surveillance on the Indian targets. The NSO Group, while disputing WhatsApp’s allegations “in the strongest possible terms”, has said that it provides the tool exclusively to “licensed government intelligence and law enforcement agencies”, and not just to anyone who wants it.

Is WhatsApp’s end-to-end encryption now compromised? Should you switch to another app — perhaps Signal or Wire or Telegram?

The very popularity of a messaging app makes it a target for hackers, cyber criminals, or other entities. Even law enforcement agencies across the world want messages to be decrypted — a demand that WhatsApp is fighting, including in India.

WhatsApp uses the Signal app protocol for its end-to-end encryption, which seems safe so far. WhatsApp has an advantage over Telegram: in Telegram, only the “secret chats” are end-to-encrypted, while on WhatsApp everything is end-to-end encrypted by default.

Those rattled by the WhatsApp episode might want to switch to Signal or Wire. However, it is important to be aware that unknown ‘zero-day’ exploits could exist for virtually every software and app in the world — and that they might be exploited at some point in the future by individuals or agencies determined to do so.