Pegasus Spyware: NSO Group's Zero-Click Exploit Explained

Pegasus Spyware Overview

• 💡 Pegasus is the flagship product of the controversial Israeli spyware vendor, NSO Group.
• 🎯 It is designed for remotely hacking mobile devices, most notably iPhones, using zero-click exploits.
• 🔑 The spyware was first released in 2011 and is designed for use against both iOS and Android phones.

NSO Group's Business Practices and Criticisms

• 🚫 NSO Group sells Pegasus exclusively to government customers, stating its intention is to combat terrorism and crime.
• ⚠️ However, the company has faced heavy criticism for selling to authoritarian governments who have allegedly abused Pegasus to target activists, journalists, and political dissidents.
• 🇺🇸 In November 2021, the Biden administration banned NSO Group from doing business in the US due to its tools being used to maliciously target various individuals.
• 📉 By December 2021, NSO Group was reportedly considering shutting down the Pegasus unit and selling the company.

Technical Functionality and Exploitation

• 🚀 Pegasus allows operators complete control over a targeted phone via a zero-click exploit, requiring no user interaction.
• 📱 Exploitation is often achieved by targeting vulnerabilities in messaging services, such as iMessage, by sending unsolicited messages.
• 🔍 Google's Project Zero detailed how Pegasus exploited iMessage's processing of GIF files, leveraging a vulnerability in iOS's core graphics PDF parser.
• ⚙️ The exploit utilized a decades-old compression algorithm (JBIG 2) to emulate circuits of arbitrary logic gates, effectively creating a small, computationally equivalent computer within the message processing.

Expert Insights on Pegasus

• 🎙️ Journalist Nicole Perlroth highlighted that Pegasus spyware requires minimal technical skill from the buyer, acting as a "push a button and you're in" tool.
• ⚠️ She noted a disturbing shift to zero-click capabilities, eliminating warnings and allowing immediate access to a phone's data.
• ⚖️ Perlroth emphasized that in the hands of governments lacking human rights protections, these tools can be powerful instruments for corruption and abuse, suppressing dissent and free press.
• 🤝 The Biden administration's blacklisting of NSO Group was a significant breach with Israeli allies, impacting the company's IPO prospects and sending a strong message to other governments regarding spyware sales.