So it requires no physical access to the phone, entirely remote and OTA (altho the phone needs to be in the general area of the injection device but the distance isn't specified. Perhaps a bluetooth thing?), and self destructs if looking for it.
It can turn on cameras and microphone and other services, read all emails and messages, and see all photos, files and passwords. Needs no "partners" to operate (ie network providers and such), beats encryption protocols, leaves no traces of being used on the device, and totally transparent to the user. If OTA injection isn't available for whatever reason it can be physically installed on even a locked device in under 5 minutes. Powerful stuff.
One odd exception: The company reveals that unlike default Safari on the iPhone the Chrome browser for Android can't be exploited by Pegasus? Weird.
Funny how you seem to be able to glean all this information. Are you reading the same source article the rest of us did? Because you're making an awful lot of assumptions.
If you didn't see those mentions you're not reading it very carefully. Those are not "assumptions", they're claims being made by NSO, the company behind Pegasus and its sister Android exploit Chrysaor.
EDIT: Ah, you're not looking at the leaked marketing doc, just the rehashed source referenced by AI. There's far more detailed info there. But should you or anyone else worry? Very doubtful since a source connected to the company indicates it's in active use on only about 350 targets, altho NSO is just one of several services that offer much the same access to user devices like Sandvine, FinFisher, Hacking Team and others. It's said to be a lucrative business, $650K to monitor just 10 iPhones, plus another half a $M in setup fees according to one client.
The company will reportedly change hands relatively soon from the Francisco Group to Verint in a $B dollar deal, tho Francisco will remain involved.
You mean the document linked above? The one where they list iOS devices up to 6.1.4?
So I'm supposed to be worried about Pegasus attacking my 6 year old iPhones? Got it. Oh, and in that document they don't claim they can get in OTA on all devices. They specifically mention is cases where OTA doesn't work that you can send someone a link in a text message to try and get them to open it.
So, not very "powerful stuff" as you originally claimed. Unless you have access to a newer document from Pegasus which shows them being able to do this on devices with iOS 11 or iOS 12.
So it requires no physical access to the phone, entirely remote and OTA (altho the phone needs to be in the general area of the injection device but the distance isn't specified. Perhaps a bluetooth thing?), and self destructs if looking for it.
It can turn on cameras and microphone and other services, read all emails and messages, and see all photos, files and passwords. Needs no "partners" to operate (ie network providers and such), beats encryption protocols, leaves no traces of being used on the device, and totally transparent to the user. If OTA injection isn't available for whatever reason it can be physically installed on even a locked device in under 5 minutes. Powerful stuff.
One odd exception: The company reveals that unlike default Safari on the iPhone the Chrome browser for Android can't be exploited by Pegasus? Weird.
Funny how you seem to be able to glean all this information. Are you reading the same source article the rest of us did? Because you're making an awful lot of assumptions.
If you didn't see those mentions you're not reading it very carefully. Those are not "assumptions", they're claims being made by NSO, the company behind Pegasus and its sister Android exploit Chrysaor.
EDIT: Ah, you're not looking at the leaked marketing doc, just the rehashed source referenced by AI. There's far more detailed info there. But should you or anyone else worry? Very doubtful since a source connected to the company indicates it's in active use on only about 350 targets, altho NSO is just one of several services that offer much the same access to user devices like Sandvine, FinFisher, Hacking Team and others. It's said to be a lucrative business, $650K to monitor just 10 iPhones, plus another half a $M in setup fees according to one client.
The company will reportedly change hands relatively soon from the Francisco Group to Verint in a $B dollar deal, tho Francisco will remain involved.
You mean the document linked above? The one where they list iOS devices up to 6.1.4?
So I'm supposed to be worried...
So, not very "powerful stuff" as you originally claimed. Unless you have access to a newer document from Pegasus which shows them being able to do this on devices with iOS 11 or iOS 12.
Most of what I've gleaned about it came from "that document", Forbes, Kapersky, and several revealing research articles at CitizenLab (a great source on several of these exploitation companies by the way). Combined with the very recent private demo reported here it appears pretty clear that NSO can do what they claim.
... and no there's no reason for you to be worried since you're hardly important enough to spend $50K plus on monitoring. You, me and every other AI member are relative nobody's who aren't worth the money or effort.
So unless your opinion is that hacking into the data on an iPhone is pretty simple then my opinion that Pegasus is "powerful stuff" to be capable of doing so is appropriate. So which is it, childs-play to hack an iPhone as you seem to be saying or powerful stuff if it can? I'll give you a few minutes to get that foot out of your mouth.
I strongly question the purpose of this article. On the surface, this is clearly FUD. Reporting on hacks without details around the specific workflow provides little to nothing from a quality of information angle. We read to enhance our understanding, not to leave us in a dark hole without a path to conclusion. This is what I would have expected:
-When did the hack take place? -What model of iPhone? Did it come straight out of the box from Apple or a 3rd party (eBay..lol)? -What version of iOS? Was it the original manufacturer codebase? -Was the device “jail broken” or modified in ANY way? -Was there a 3rd party application installed that increased the attack surface of the device due to poor security implementation? -What radios (frequencies, versions of protocols, etc) were active and communicating at the time of the purported hack? -What Wi-Fi access point(s) and/or Bluetooth devices was the device communicating with (if any)? If Wi-Fi, what type of security/authentication was being used (WPA/WPA2, TKIP/AES, password/certificate, etc)? If Bluetooth, what device and what level of access was it allowed? -Did the demonstrators have administrative access to the network(s) that the device was communicating on? -What cellular network was it connected to, if any? -Was NFC involved? -Was the device locked with a PIN, passcode, Touch ID, etc? If yes, which one (with details around that)? -Had the device just been turned on or had it been unlocked and played with prior to the hack? -What were the specific security and privacy settings of the device (including location)?
I strongly question the purpose of this article. On the surface, this is clearly FUD. Reporting on hacks without details around the specific workflow provides little to nothing from a quality of information angle. We read to enhance our understanding, not to leave us in a dark hole without a path to conclusion. This is what I would have expected:
-When did the hack take place? -What model of iPhone? Did it come straight out of the box from Apple or a 3rd party (eBay..lol)? -What version of iOS? Was it the original manufacturer codebase? -Was the device “jail broken” or modified in ANY way? -Was there a 3rd party application installed that increased the attack surface of the device due to poor security implementation? -What radios (frequencies, versions of protocols, etc) were active and communicating at the time of the purported hack? -What Wi-Fi access point(s) and/or Bluetooth devices was the device communicating with (if any)? If Wi-Fi, what type of security/authentication was being used (WPA/WPA2, TKIP/AES, password/certificate, etc)? If Bluetooth, what device and what level of access was it allowed? -Did the demonstrators have administrative access to the network(s) that the device was communicating on? -What cellular network was it connected to, if any? -Was NFC involved? -Was the device locked with a PIN, passcode, Touch ID, etc? If yes, which one (with details around that)? -Had the device just been turned on or had it been unlocked and played with prior to the hack? -What were the specific security and privacy settings of the device (including location)?
I have more but I’ve made my point.
I agree that there's some level of FUD here. It's not anything a single one of us would need to waste a second worrying about. We're not that important.
Try this link which answers some of your questions, but expecting answers to even most of them would be silly considering the exploits are intended to remain secret. If it was known how/what/when then the product would not be as valuable to those purchasing it.
Comments
You mean the document linked above? The one where they list iOS devices up to 6.1.4?
So I'm supposed to be worried about Pegasus attacking my 6 year old iPhones? Got it. Oh, and in that document they don't claim they can get in OTA on all devices. They specifically mention is cases where OTA doesn't work that you can send someone a link in a text message to try and get them to open it.
So, not very "powerful stuff" as you originally claimed. Unless you have access to a newer document from Pegasus which shows them being able to do this on devices with iOS 11 or iOS 12.
... and no there's no reason for you to be worried since you're hardly important enough to spend $50K plus on monitoring. You, me and every other AI member are relative nobody's who aren't worth the money or effort.
So unless your opinion is that hacking into the data on an iPhone is pretty simple then my opinion that Pegasus is "powerful stuff" to be capable of doing so is appropriate.
So which is it, childs-play to hack an iPhone as you seem to be saying or powerful stuff if it can? I'll give you a few minutes to get that foot out of your mouth.
-When did the hack take place?
-What model of iPhone? Did it come straight out of the box from Apple or a 3rd party (eBay..lol)?
-What version of iOS? Was it the original manufacturer codebase?
-Was the device “jail broken” or modified in ANY way?
-Was there a 3rd party application installed that increased the attack surface of the device due to poor security implementation?
-What radios (frequencies, versions of protocols, etc) were active and communicating at the time of the purported hack?
-What Wi-Fi access point(s) and/or Bluetooth devices was the device communicating with (if any)? If Wi-Fi, what type of security/authentication was being used (WPA/WPA2, TKIP/AES, password/certificate, etc)? If Bluetooth, what device and what level of access was it allowed?
-Did the demonstrators have administrative access to the network(s) that the device was communicating on?
-What cellular network was it connected to, if any?
-Was NFC involved?
-Was the device locked with a PIN, passcode, Touch ID, etc? If yes, which one (with details around that)?
-Had the device just been turned on or had it been unlocked and played with prior to the hack?
-What were the specific security and privacy settings of the device (including location)?
I have more but I’ve made my point.
Try this link which answers some of your questions, but expecting answers to even most of them would be silly considering the exploits are intended to remain secret. If it was known how/what/when then the product would not be as valuable to those purchasing it.
Note that there are apparently at least three ways that a device can be commandeered: Wirelessly (Bluetooth? There are apparently range limitations), via a specially crafted text if wireless is not active (only requires opening the message according to sources), or physical access.
https://citizenlab.ca/2018/09/hide-and-seek-tracking-nso-groups-pegasus-spyware-to-operations-in-45-countries/
Citizen Lab appears to be a nightmare for them. More articles here too:
https://citizenlab.ca/tag/nso-group/