Hello World! New leaks have emerged which reveal how advanced
spyware being sold to governments is apparently being used by dictatorial regimes to target
journalists and activists. These are actually really quite shocking developments, if you
care about your privacy and security in the slightest, this video is a must watch - it’s
a complex topic but I’ve done my best to distill it. This is one of the more important
things I’ve covered on this channel, as such it’s the only thing I’m covering
in this episode of the weak web where we break down and dissect cyber security related tech
news The Israeli company NSO group - a billion
dollar corporation which wikipedia quite fittingly describes as a cyberarms firm is at the center
of the drama - they make spyware. As of 2020 they’ve got more than 500 employees working
day in, and day out trying to hack these things, mobile phones. NSO focuses almost exclusively
on trying to find vulnerabilities in iOS and Android devices. Simply because our phones
are the perfect surveillance tools, they have a microphone, camera, they know where we are,
what we’re doing - at all times and have access to both our communication in real time
and logs of past messages. Not only this, but the spyware NSO develops
is incredibly advanced - “zero click” attack vectors are NSO’s speciality, their
spyware has the ability to infect your phone simply by sending you a text. Protecting yourself
from this malware isn’t a case of don’t open suspicious emails or click dodgy links.
No, you can become a victim simply by receiving a malicious text message, laden with nasty
code known as a “zero click” exploit, designated as such because it requires no
user interaction to execute - the malware could then just delete the offending text
so you’d have no idea you were ever targeted. NSO packages vulnerabilities like these into
a spyware tool called Pegasus. Once installed, Pegasus can listen to your device’s microphone,
peep through the camera, retrieve saved files - meander through your messages, and so on.
You think you’re secure because you use “Signal” which employs fancy end to end
encryption? Not so fast, end to end encryption is largely irrelevant once Pegasus is installed
on your device.
But Seytonic, surely these hacks are only ever used on terrorists and criminals, right?
Right?
Well the new leaks confirm Pegasus is often sold to countries of dubious moral standing.
This is where the problems begin, NSO claims this spyware is sold to governments on the
proviso it should only be used to fight crime and terrorism, their website homepage bears
the phrase “cyber intelligence for global security and stability” - let me tell you
why that’s a little ironic.
The recent investigation coordinated by Forbidden Stories with technical support of Amnesty
International’s Security Lab details how according to them, 50 thousand phone numbers
were potentially targeted using the Pegasus spyware. These include heads of state, activists
and journalists, including Jamal Khashoggi’s family. If you’re not familiar with Jamal
Khashoggi, he was an Arabian journalist who often said things the Saudis didn’t quite
like. Following which, he was then assassinated in Istanbul and quite literally cut up into
little pieces by Saudi Operatives. All the while Pegasus spyware was allegedly being
used to spy on his family - the allegation is that NSO’s Pegasus spyware aided in executing
his assination - a claim NSO flatly denies.
Countries which have been uncovered to have had contracts with NSO to use Pegasus include
Saudi Arabia (surprise, surprise), Bahrain, Azerbaijan, the UAE among others. This list
of countries looks small, until you realise these are only the ones we know about - NSO
sells to a total of 40 unnamed countries. One common vector of “zero-click” exploits
that Pegasus uses to propagate itself is via iMessage. The CTO of threat analysis company
Vectra says that “the iOS iMessage service is a bit of a mess from a security perspective”.
Problem being, as Apple adds more features to iMessage it comes with the cost of increasing
the overall attack surface for bad actors. More features = more potentially exploitable
bugs. He says “Accepting and processing messages from anyone is the equivalent of
running a network connected to the internet with no firewall”.
Apple was forced to release a statement on the situation. You can pause it and read it
in full, but they essentially say that they’re not a fan of governments hacking journalists,
and that they’re trying to make iOS more secure.
NSO themselves creeped out of their evil lair to make a statement on these findings. They
claim that “The report by Forbidden Stories is full of wrong assumptions and uncorroborated
theories”, “Their sources have supplied them with information which has no factual
basis, as evident by the lack of supporting documentation for many of their claims.”
NSO is correct when they refer to lack of supporting documentation, though in a bid
to protect their sources it’s no surprise that amnesty and forbidden stories aren’t
going to be very forthcoming with details on where from which they procured the leak.
They go on to say “The claims that the data was leaked from our servers, is a complete
lie and ridiculous, since such data never existed on any of our servers.” Here they’re
referring to the claim that 50,000 phone numbers were targeted with Pegasus spyware. And to
be fair I would like at least some kind of a rough explanation of how that number of
50,000 victims was derived. I don’t know how the Pegasus malware operates, obviously
- but it’s not hard to believe there is no central server and each Pegasus customer
operates their own instance of the Pegasus malware, in which case it’s not immediately
obvious how amnesty came to the conclusion that 50,000 people were targeted.
That being said, 50,000 victims would not surprise me in the slightest. In yesteryears
to surveil someone meant having to send a guy armed with binoculars in a car with tinted
windows to follow someone around. Whereas with Pegasus you can surveil someone’s every
move with the push of a button, the conversation of is it really worth dedicating resources
to surveil someone is over.
Accusations of enabling unlawful surveillance aren’t new to NSO. As of 2019 WhatsApp is
suing NSO on the basis Pegasus exploited a vulnerability in Whatsapp to send malicious
messages to roughly 1400 mobile phones, with the intent of installing Pegasus malware on
the devices of “journalists, human rights activists, political dissidents, and diplomats.”
In an apparent attempt to clear up their image, last month NSO released their first transparency
and responsibility report. In which they claim since 2016 they’ve cancelled the contracts
of 5 customers due to human rights concerns, costing them in excess of $100 million in
lost revenue. And that they’ve refused to even sign contracts worth in excess of $300
million as a result of their human rights due diligence procedure. I’m not too sure
what to make of this report - it reads quite well - but actions speak louder than words,
and the evidence shows us that despite any efforts NSO may be making to clean up - it
ain’t enough.
Before we get to what you can do - if anything to prevent yourself falling victim to spyware,
I need to tell you about today’s sponsor Linode! VPNs are useful, and aim to keep you
private and secure, but they come with a trove of issues. Mainly, would you entrust a VPN
company with your traffic over your ISP? The bottom line is that if you didn't set up the
VPN server yourself, you really can't be sure that these VPN companies won't keep logs,
sell your data, or monitor your traffic. That's why I’ve teamed up with Linode to give you
the opportunity to host your own private VPN for free. Linode is a totally customisable
cloud hosting platform with a whole host of server apps you can install with one click.
Using their wireguard or openVPN apps you can spin up a private VPN controlled wholly
by yourself in a matter of minutes.
Linode launched way back in 2003, that’s 3 years before AWS was even a thing, Linode
doesn’t spend a second on side hustles like grocery chains or reading you bedtime stories,
cloud computing is what they do best, and is their only focus. Linode is offering all
of you guys $100 in free credit just for signing up, use your $100 to instantiate your private
VPN or literally anything else cloud computing related. They have 24/7 phone support (which
is a godsend in the world of servers) so you’ll never be left out in the cold.
Go to linode.com/seytonic or click the link in the description to claim your free $100.
I know what you’re thinking, so Seytonic, what do? On an individual level: there’s
not much you can do; the age-old advice of steering clear of dodgy looking links is superfluous
when governments armed with zero-click exploits can ensnare you with nothing but your phone
number and a simple click of a mouse.
However there have already been some actions against NSO in the wake of these accusations.
Firstly Amazon, having come to the conclusion that having anything to do with NSO is a PR
disaster in the waiting, has banned NSO from using Amazon web services - indefinitely - shutting
down NSO’s account with them.
Israel themselves have launched a review into whether rules on Israel’s export of cyberweapons
such as Pegasus should be tightened - it’s too soon to say if this actually means anything,
or if this action is just in an attempt to make it look like they’re doing something.
But even if Israel tightens the rules, no doubt some other country with more lax laws
will fill the gap in the market. The demand from authoritarian regimes for this kind of
spyware exists, and that’s never going to change.
No doubt this isn’t the last we’ll hear of NSO’s Pegasus - I’ll be sure to cover
any developments in upcoming episodes. Make sure to let me know in the comments what you
think of this whole saga.
If you enjoy this kind of video make sure to help me out by tapping the like button
for the youtube AI as well as turning on those sub notifications. If you’re looking for
something to watch next go watch my previous video on how malicious hackers were caught
hiding credit card details in images.
If you get a lot of value from this series of videos do consider becoming a channel member,
as always sources will be linked in the video description, stay tuned for more hacking videos,
have a good one.