Spyware Proliferates To 45 Countries

The malicious spyware has also been found in use in countries known for targeting human rights. The infamous Pegasus spyware, which targets iPhones and Android devices, has allegedly infiltrated 45 different countries across the globe, and six of those countries have used surveillance malware in the past to abuse human rights, a group of researchers claimed recently.

Researchers from the Universityof Toronto's The Citizen Lab scanned the internet in a massive project that took place between 2016 and 2018, sniffing out servers associated with the Pegasus mobile spyware, attributed to Israel-based company NSO Group as an offering for state-level actors around the world.

“The number of Pegasus servers we detected in our scans ballooned from about 200 in 2016 to almost 600 in 2018.  This may be an indication that NSO Group is scaling up their operations,” Bill Marczak, senior research fellow at The Citizens Lab and one of the researchers on the team, told Threatpost.

The malware has been active since August 2016 when it was discovered that the NSO Group was selling the mobile spyware to governments and third-parties who wanted its surveillance capabilities in order to read texts, track calls, collect passwords, trace phone locations and gather data from apps of victims.

Pegasus is generally spread through a specially crafted exploit link (via phishing techniques) which when clicked delivers a chain of zero-day exploits to penetrate security features on the phone. The Citizen Lab’s latest report shows that Pegasus has grown more widespread, and alleges that it’s being used by certain countries to target human rights.

That includes the expansion of Pegasus usage in Gulf Cooperation Council countries in the Middle East, particularly to track dissidents, such as UAE activist Ahmed Mansoor, who was targeted by the spyware in 2016; and an Amnesty International staffer and Saudi activist in June 2018.

“Our findings paint a bleak picture of the human-rights risks of NSO’s global proliferation,” researchers said in a recent post.

“At least six countries with significant Pegasus operations have previously been linked to abusive use of spyware to target civil society, including Bahrain, Kazakhstan, Mexico, Morocco, Saudi Arabia and the United Arab Emirates.”

The spyware has been abused in this way in the past, in 2017, it was discovered that dozens of Mexican journalists and lawyers (and even a child) had their devices infected by Pegasus in a campaign believed to be carried out by the nation’s government. Marczak, says that the spyware’s civil rights abuse is a sign of what’s to come: “Civil society will increasingly find itself the target of this type of sophisticated surveillance unless the governments better regulate the spyware industry,” he said.

Overall, between August 2016 and August 2018, the research team detected 1,091 IP addresses and 1,014 domain names matching the behavior of the exploit link and command-and-control (C2) server associated with Pegasus.

To track various Pegasus operators, researchers at The Citizen Lab also developed a novel technique (dubbed Athena) to cluster matches of the spyware’s servers into 36 distinct Pegasus systems, each one which appears to be run by a separate operator.  Then, the team probed tens of thousands of ISP DNS caches around the world, assuming that infected devices would routinely look up the domain names for the operator’s servers using their ISP’s DNS servers.

“We designed and conducted a global DNS cache probing study on the matching domain names in order to identify in which countries each operator was spying,” researchers said. “Our technique identified a total of 45 countries where Pegasus operators may be conducting surveillance operations. At least 10 Pegasus operators appear to be actively engaged in cross-border surveillance.”

The 45 countries found harboring the spyware are: Algeria, Bahrain, Bangladesh, Brazil, Canada, Cote d’Ivoire, Egypt, France, Greece, India, Iraq, Israel, Jordan, Kazakhstan, Kenya, Kuwait, Kyrgyzstan, Latvia, Lebanon, Libya, Mexico, Morocco, the Netherlands, Oman, Pakistan, Palestine, Poland, Qatar, Rwanda, Saudi Arabia, Singapore, South Africa, Switzerland, Tajikistan, Thailand, Togo, Tunisia, Turkey, the UAE, Uganda, the United Kingdom, the United States, Uzbekistan, Yemen and Zambia.

Interestingly the research team found several infections in United States IP space – but the Pegasus customers were not linked to the United States, indicating cross-border compromise.

When The Citizen Lab presented their findings to NSO Group, the company released a statement:
“There are multiple problems with Citizen Lab’s latest report. Most significantly, the list of countries in which NSO is alleged to operate is simply inaccurate. NSO does not operate in many of the countries listed. The product is only licensed to operate in countries approved under our Business Ethics Framework and the product will not operate outside of approved countries.”

However, The Citizen Lab researchers refuted those claims and stated, “The continued supply of services to countries with problematic human-rights track records and where highly publicized abuses of spyware have occurred raise serious doubts about the effectiveness of this internal mechanism, if it exists at all.”

Threatpost

You Might Also Read:

Iran Targets Kurds With Spyware:

Spyware Firms In Breach Of Export Sanctions:

 

« Has Demand For Cyber Security Skills Hit Crisis Point?
UK Gets Offensive: New Task Force To Deal With Russia & Terrorists »

ManageEngine
CyberSecurity Jobsite
Check Point

Directory of Suppliers

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

Tines

Tines

The Tines security automation platform helps security teams automate manual tasks, making them more effective and efficient.

Resecurity

Resecurity

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

Securezoo

Securezoo

Securezoo's mission is to simplify and enhance information security by providing trusted security guidance, products, and information to small and mid-sized businesses and security professionals.

Siepel

Siepel

Siepel manufactures high quality shielded rooms and anechoic chambers dedicated to TEMPEST, NEMP & HIRF.

Akheros

Akheros

Akheros develops cybersecurity learning algorithms which anticipate, detect and prevent offensive and incongruous behaviors of M2M interactions.

Pradeo

Pradeo

Pradeo Security offers a complete, automatic and seamless protection to mobile devices and applications, aligned with your organization security policy while preserving business agility.

Honeynet Project

Honeynet Project

The Honeynet Project is a leading international non-profit security research organization, dedicated to investigating the latest attacks and developing open source security tools.

Sliced Tech

Sliced Tech

Sliced Tech provides enterprise grade managed Cloud services, including Security-as-a-Services, aimed at meeting the needs of commercial and government clients from within Australia.

CyberGreen Institute

CyberGreen Institute

The CyberGreen Institute is a global non-profit and collaborative organization conducting activities focused on helping to improve the health of the global Cyber Ecosystem.

Cybersecurity Collaborative

Cybersecurity Collaborative

CyberSecurity Collaborative is a forum for CISOs to share information that will collectively make us stronger, and better equipped to protect our enterprises from those seeking to damage them.

National Forensic Sciences University (NFSU) - India

National Forensic Sciences University (NFSU) - India

National Forensic Sciences University is the world’s first and only University dedicated to Digital Forensic and allied Sciences.

Suridata

Suridata

Suridata’s SaaS Security platform enables organizations to secure the use of SaaS applications.

RKVST

RKVST

RKVST is a powerful tool that builds trust in multi-party processes when it’s critical to have high assurance in data for confident decisions.

Atlas VPN

Atlas VPN

Atlas VPN is a highly secure freemium VPN service with a goal to make safe and open internet accessible for everyone.

Intel Ignite

Intel Ignite

Intel Ignite is an internationally renowned acceleration program for early-stage deep tech startups.

Vernetzen

Vernetzen

Vernetzen is an industrial network and cybersecurity innovator focused on delivering practical solutions to connect and secure industry across the globe.

ReformIT

ReformIT

ReformIT is a Managed IT Service and Security provider with many years experience helping companies find the right IT solutions to meet the needs of their businesses.

Black Duck Software

Black Duck Software

Black Duck (formerly the Synopsys Software Integrity Group) is the market leader in application security testing (AST).