4 ms·

I've been hearing of Pegasus for a good 3 years now. Is it so hard to patch devices to close whatever means it uses to hack them? Or is there also a Pegasus V2

I've been hearing of Pegasus for a good 3 years now. Is it so hard to patch devices to close whatever means it uses to hack them? Or is there also a Pegasus V2, V3, etc that plays catchup with OS's security patches?

meibo 5y ago
It's the name of a iOS malware/RAT by NSO, an Israeli company that likes to sell their software to governments offering varying degrees of personal freedom around the world. It's been around with zero-click exploits for years, and apparently even now, after their big iMessage "security" rewrite with iOS 14. Very likely that they have other entrypoints as well though.
- drexlspivey 5y ago
  Pegasus was also used by Saudi Arabia to hack Jeff Bezos’ phone and it was MBS (the crown prince) himself that sent the iMessage to him.
  - mandeepj 5y ago
    It was a WhatsApp missed call
  - thehours 5y ago
    WhatsApp video [1] [1] https://www.wired.co.uk/article/jeff-bezos-phone-hack-mbs-saudi-arabia https://www.wired.co.uk/article/jeff-bezos-phone-hack-mbs-sa...
  - Firebrand 5y ago
    Did that actually happen? I thought the Saudi Arabia hack was a convenient tale conjured up by Bezos’ team to cover up that his girlfriend was the one sending his pictures and messages to her brother, who in turn tried selling it to the National Enquirer.
    - jazzyjackson 5y ago
      Other way around, National Enquirer was the fence using the brother as a cover story for the hack. (National Enquirer is a friend of Saudi Arabia by the way, if you didn't catch the special edition "The New Kingdom" magazine published by their parent company)
- stefan_ 5y ago
  Just so no one is confused: as the Facebook lawsuit confirmed, NSO is running the C&C servers for their clients. They are not selling some software, "do what you want". It is NSO running these operations. They are directly implicated in whatever their malware ends up doing.
  - collaborative 5y ago
    So Pegasus somehow manages to stay alive patch after patch when every other exploit and virus out there gets shut down Is it not clear that at least Apple must be involved in this too? Who else is?
    - 3np 5y ago
      ...No, it is not clear.
    - marcan_42 5y ago
      Every other exploit and virus is used by impatient idiots. NSO knows how to stockpile exploits. I've been there done that. It's how we pretty much kept Wii homebrew available consistently throughout the console's life. We had the next exploit ready before Nintendo patched the current one. Apple isn't involved. NSO are just good at their job.
      - collaborative 5y ago
        Thanks for the explanation. It might seem obvious to people involved in this type of work, but I honestly found it hard to believe
quenix 5y ago
Pegasus does indeed play catchup. They seem to constantly introduce new vulnerabilities, each more advanced than the last. The whole operation is incredibly sophisticated—this report [0] by Amnesty International is a great read. They also constantly upgrade their infrastructure—for example, they have at least -four- major versions of their C&C infrastructure, which they dub the "Pegasus Anonymizing Transmission Network". :( [0]: https://www.amnesty.org/en/latest/research/2021/07/forensic-methodology-report-how-to-catch-nso-groups-pegasus/ https://www.amnesty.org/en/latest/research/2021/07/forensic-...

meibo 5y ago

It's the name of a iOS malware/RAT by NSO, an Israeli company that likes to sell their software to governments offering varying degrees of personal freedom around the world. It's been around with zero-click exploits for years, and apparently even now, after their big iMessage "security" rewrite with iOS 14. Very likely that they have other entrypoints as well though.

drexlspivey 5y ago
Pegasus was also used by Saudi Arabia to hack Jeff Bezos’ phone and it was MBS (the crown prince) himself that sent the iMessage to him.
- mandeepj 5y ago
  It was a WhatsApp missed call
- thehours 5y ago
  WhatsApp video [1] [1] https://www.wired.co.uk/article/jeff-bezos-phone-hack-mbs-saudi-arabia https://www.wired.co.uk/article/jeff-bezos-phone-hack-mbs-sa...
- Firebrand 5y ago
  Did that actually happen? I thought the Saudi Arabia hack was a convenient tale conjured up by Bezos’ team to cover up that his girlfriend was the one sending his pictures and messages to her brother, who in turn tried selling it to the National Enquirer.
  - jazzyjackson 5y ago
    Other way around, National Enquirer was the fence using the brother as a cover story for the hack. (National Enquirer is a friend of Saudi Arabia by the way, if you didn't catch the special edition "The New Kingdom" magazine published by their parent company)
stefan_ 5y ago
Just so no one is confused: as the Facebook lawsuit confirmed, NSO is running the C&C servers for their clients. They are not selling some software, "do what you want". It is NSO running these operations. They are directly implicated in whatever their malware ends up doing.
- collaborative 5y ago
  So Pegasus somehow manages to stay alive patch after patch when every other exploit and virus out there gets shut down Is it not clear that at least Apple must be involved in this too? Who else is?
  - 3np 5y ago
    ...No, it is not clear.
  - marcan_42 5y ago
    Every other exploit and virus is used by impatient idiots. NSO knows how to stockpile exploits. I've been there done that. It's how we pretty much kept Wii homebrew available consistently throughout the console's life. We had the next exploit ready before Nintendo patched the current one. Apple isn't involved. NSO are just good at their job.
    - collaborative 5y ago
      Thanks for the explanation. It might seem obvious to people involved in this type of work, but I honestly found it hard to believe

quenix 5y ago

Pegasus does indeed play catchup. They seem to constantly introduce new vulnerabilities, each more advanced than the last. The whole operation is incredibly sophisticated—this report [0] by Amnesty International is a great read. They also constantly upgrade their infrastructure—for example, they have at least -four- major versions of their C&C infrastructure, which they dub the "Pegasus Anonymizing Transmission Network". :( [0]: https://www.amnesty.org/en/latest/research/2021/07/forensic-methodology-report-how-to-catch-nso-groups-pegasus/ https://www.amnesty.org/en/latest/research/2021/07/forensic-...